a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56 | Triage

Analysis

max time kernel
138s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:22

Sharing

Report Analysis Logs

General

Target

CoralDb.dll
Size

1.0MB
MD5

c97b98c70ec8e4407879270b3ffe8984
SHA1

f226b353a5090931186842b36f01fb6d3f089760
SHA256

4e7b5abf6df3b4ca12e1edb1543344452446da9ac3fdb27e5bf754ae09906714
SHA512

f8f3eca681855bbaee443053f8429c4785838edb379588beb501fa6ac6d0de8ea6c2ec9136a3d8a0005bb48efd7fd7a2a9741eb78d3dca8e49081ee4a817275b
SSDEEP

24576:NopftMsUXD8fv+A8x1+RsZnnIIQvzNnqf4P9pTmboiiSDEgd4:IeGx8LIef4P9pTmboiiS5d4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2456	3036	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3036	4352	rundll32.exe	84
PID 4352 wrote to memory of 3036	4352	rundll32.exe	84
PID 4352 wrote to memory of 3036	4352	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralDb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralDb.dll,#1
  2⤵
  PID:3036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 652
    3⤵
    - Program crash
    PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3036 -ip 3036
1⤵
PID:3648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads