1c95e2de3bca3fea01374b156e547a840d0adf592d7ef17155c54fcbc6d69841 | Triage

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 09:09

Sharing

Report Analysis Logs

General

Target

SFhelper.dll
Size

60KB
MD5

a2f3195a34dfb07900fc784a32a37d3f
SHA1

7e60c4ec6e1aece0de663f5ca614d22a77cc680b
SHA256

c0234f29167c2d0b6284dd3a32a0a6c1ab9bbd2f2475ccf5c3e758d4070835ea
SHA512

3aaaebdad04878af5a9692308b1ee7f91dd6682f9b046a23e803001bb6df5b87550a06c1c3b4be93169a582935859e3af0fce2947e01d56ead3bb204a9458c55
SSDEEP

1536:6QkiaCePX+reI3QkQpWhuVXSigCWgOQgrfqC:6QkiDePiP3mpWwVXSigKONL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2140	4072	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4072	2772	rundll32.exe	82
PID 2772 wrote to memory of 4072	2772	rundll32.exe	82
PID 2772 wrote to memory of 4072	2772	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SFhelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SFhelper.dll,#1
  2⤵
  PID:4072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 592
    3⤵
    - Program crash
    PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4072 -ip 4072
1⤵
PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads