a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56 | Triage

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:22

Sharing

Report Analysis Logs

General

Target

Coral.dll
Size

583KB
MD5

afac79e92e3785299f191e74de3f366a
SHA1

d00b781bffff2967a434bc8cb69d4e6202e6f57c
SHA256

e2fd8e0e1de3035c9cddc201fea8cbdc89f91e89bfd60a1ab70bfd317e3043b8
SHA512

212f730fcd0c587ca3920c4dfbcf1266a96c87bb045f2b0ee7e80e0551c97b2978be0024ff14e3afc4e6025d273fe7508de1d7ec08d6d5ba24201a0f502f5806
SSDEEP

12288:hvixHSC0MYWG50tUvuhyGiCHnUgNGzaf3/l/2jjSj:hvixyC0MYWG50Wvu7HNGzaf3/l/wSj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1196	3756	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 3756	4420	rundll32.exe	80
PID 4420 wrote to memory of 3756	4420	rundll32.exe	80
PID 4420 wrote to memory of 3756	4420	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Coral.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Coral.dll,#1
  2⤵
  PID:3756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 704
    3⤵
    - Program crash
    PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3756 -ip 3756
1⤵
PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads