c291f69fe2c0a95a9949ac15d06182344d646cf591752e0db27e2a09c90a97e6 | Triage

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 10:12

Sharing

Report Analysis Logs

General

Target

GFSDK_Aftermath_Lib.x64.dll
Size

32KB
MD5

96a5c5e060ca83652e5798798cb15cb9
SHA1

241fa3e48e496086acd39dab55e425cb51bd780d
SHA256

51de58aeda0a44955ff9d00d617e2dedc78e66bf738bdad3d332b18888bb8f4a
SHA512

bb3713fcd3a3c67f96c3fc5099ccbcb5aff3984363472c6545ec0d2240b17d2930bcca077a6322ffa5e27388d36c26d2857fde58ebb9c4f262ace2446d0ee1f4
SSDEEP

768:RrSx+nnWOuElBOwLL7fVXRRMs+vdqbDSj0H:ZSx+tPOw5PMGbDSg

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1704	1676	rundll32.exe	28
PID 1676 wrote to memory of 1704	1676	rundll32.exe	28
PID 1676 wrote to memory of 1704	1676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\GFSDK_Aftermath_Lib.x64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1676 -s 80
  2⤵
  PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads