a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56 | Triage

Analysis

max time kernel
138s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 08:22

Sharing

Report Analysis Logs

General

Target

CoralUI.dll
Size

1.4MB
MD5

2c157ecdaf8a1cec3106f214db9dd974
SHA1

a0505c990694c03b349fbc7597935807c0bfcf52
SHA256

6662595d4183df68a822c715ed3ea07e0db1c7478b76747ecfc737fc183b0aa4
SHA512

f52c4419d64426aa6a914a46a2885b77a488d2442e4b34109d569222c187a9a42872745eb0603221791cc4aae119bdfcf0776d597a5f08aebccbd051462c773a
SSDEEP

24576:olq4VOZD8+hakWpXo9AadfnzcSknBC9BE8xHRwjZPMaNdrsnIy8R:zEy8+hak9a691oOedrsIy8R

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	1484	WerFault.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1484	4396	rundll32.exe	88
PID 4396 wrote to memory of 1484	4396	rundll32.exe	88
PID 4396 wrote to memory of 1484	4396	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralUI.dll,#1
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 704
    3⤵
    - Program crash
    PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1484 -ip 1484
1⤵
PID:1364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads