cce315b55368d418f7c32eb2cd0b479a6f3a46b00d194f727f38b10596497d2e | Triage

Analysis

max time kernel
51s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 12:30

Sharing

Report Analysis Logs

General

Target

$COMMONFILES/Angels/WebSafe.dll
Size

411KB
MD5

27a195cbea12fa20c3c041cf43c31d20
SHA1

eec787243c6b2ed54a8d1ed65452b7ac0c4b30b7
SHA256

482d9fef60f9f8da719141b4481783951ceef39f832a66b176b8525d8a7518fe
SHA512

c7169ad6798bcb650baf913b9b9c4c7655487ab34800e33318c31826498a5297ed12ddcf72899b7da39615e0f524be0856293492183b5ce4b6f81215b1f2b60b
SSDEEP

3072:M6o/IOSN2Qv32fQNA6rPEvDKke+8q+g4+gECW5:MZ/IOSNPfNjrPebMpg4S5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4084	2384	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2384	2516	rundll32.exe	80
PID 2516 wrote to memory of 2384	2516	rundll32.exe	80
PID 2516 wrote to memory of 2384	2516	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\WebSafe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$COMMONFILES\Angels\WebSafe.dll,#1
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 660
    3⤵
    - Program crash
    PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2384 -ip 2384
1⤵
PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads