8d87897242b12a5327ce2f4d6b5087a9a7c6071722c34e849b95730d6b7c1134 | Triage

Analysis

max time kernel
41s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 20:34

Sharing

Report Analysis Logs

General

Target

system/ifc23.dll
Size

228KB
MD5

3a1970d3e997b018fbc776560740b95e
SHA1

7aef4ff0fbfa4ab39331a4e63939b43b265a6a76
SHA256

2a4751b579ab8b68585d61dcef08fa6e9f5b853ce429b026e18a83ae1960fb1c
SHA512

7a1fe0acf586b63a514608fa12096c11cdc058f4d36ae9681cee3a42fddae9c9cdd6245472ae3e848761081406a732c0f995a3db477637c2ef1953898abc98e2
SSDEEP

3072:wl6XLRFlPbMb8dBI2pzhQMqJ+GepSkJGQQJHo0wPI+E5aWl:XfY8dHJhQMqw/D8WkUk

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
32	3536	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 3536	3860	rundll32.exe	80
PID 3860 wrote to memory of 3536	3860	rundll32.exe	80
PID 3860 wrote to memory of 3536	3860	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\system\ifc23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\system\ifc23.dll,#1
  2⤵
  PID:3536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 628
    3⤵
    - Program crash
    PID:32

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3536 -ip 3536
1⤵
PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads