a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:22

Target

CoralTrident.dll
Size

506KB
MD5

993b059afd143fcd153d4aa1e456a5bb
SHA1

8a7bdd26b963b65cd490f25c21340f5f10dccb1d
SHA256

aecae09d1637cd5910b06fa41ee73fb2cdde6c8756a535152c6fec9cb4b9253b
SHA512

dc5dc8ca1f4ee7a88ad43b790d1563ff27c335df6931eaa0041cf78c4602a56792c93c6a1cfa71b42693c91dd76366186b27b3f63c7f05a3440fb97f47761d0d
SSDEEP

6144:3lkKz9RPBkGKRHTNbxuecoTlj7DifMw9OrJhNVtUV3SY+2ad1TXc+fcOgCiSC:nBWTNnhcfMagraJrOTX33C

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4388	920	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 920	3300	rundll32.exe	82
PID 3300 wrote to memory of 920	3300	rundll32.exe	82
PID 3300 wrote to memory of 920	3300	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralTrident.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralTrident.dll,#1
  2⤵
  PID:920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 732
    3⤵
    - Program crash
    PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 920 -ip 920
1⤵
PID:4804