a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56 | Triage

Analysis

max time kernel
79s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 08:22

Sharing

Report Analysis Logs

General

Target

CoralApp.dll
Size

109KB
MD5

007807250a94f82a475c21908f840ea5
SHA1

187cba9542083eefab386b2f51610a3a9eed0fde
SHA256

f8af22dcba5f19703cf3a8bb36b14c7c8f1c4797dbc383844f78db3eacbcf4cd
SHA512

58c48e86a9635bac92569fcd5afa48508c96a833576eedd76efb010883f0e711baab18f79bfa92be71a5b85256b60bbc9ab3bb2da3243a460d37e3aee898d241
SSDEEP

3072:0fbZOmtLctOIJ2B5H4vNdvEKl19U16LS3HOgZAwXjSy:8FOmtgtOS2B54ga19U1j3HOgZ1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1876	4456	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 4456	408	rundll32.exe	80
PID 408 wrote to memory of 4456	408	rundll32.exe	80
PID 408 wrote to memory of 4456	408	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralApp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralApp.dll,#1
  2⤵
  PID:4456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 640
    3⤵
    - Program crash
    PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4456 -ip 4456
1⤵
PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads