95a8e22f4586b962c8bbe268f28b9561ecfafc06bee75f3571ced253d66d5531 | Triage

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
02-07-2024 16:58

Sharing

Report Analysis Logs

General

Target

icudt30.dll
Size

1.5MB
MD5

38bb7cee2aa52930485939771c44ab2a
SHA1

dd028b21c611873c28de3e80f04e787250f97219
SHA256

8c04f1ab3a07e21e88d678e6742efc69900bacf73b1e18f97b25115d3cb3e4d5
SHA512

b8169042f45b7fd08e7aab17a05fe48dca8ffd203d3b841a990d8836da33bcfaf39ee5953706281c4a47148736c5ed1d51956eca6e8efb67af9d137e1dfe7849
SSDEEP

24576:KqaX8Bv2axcToy/oH0C/iwESlzJ5uM8H2ZIuNjMSpnhmW8c238uoL/:88BvPy/i0CKwFEvnckB

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3056 wrote to memory of 2208	3056	rundll32.exe	WerFault.exe
PID 3056 wrote to memory of 2208	3056	rundll32.exe	WerFault.exe
PID 3056 wrote to memory of 2208	3056	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\icudt30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3056 -s 80
2⤵
PID:2208

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...