c4e6f9331755878841a23e1bc15def01e21a434f65c3ea5f978901faee26d13d | Triage

Analysis

max time kernel
147s
max time network
266s
platform
windows10-2004_x64
resource
win10v2004-20240704-es
resource tags

arch:x64arch:x86image:win10v2004-20240704-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
05-07-2024 14:11

Sharing

Report Analysis Logs

General

Target

ch/libipt-32.dll
Size

146KB
MD5

00b8f0cba176db6fd6edbef448e2fb03
SHA1

c89078f9f5c8f913bd5788a0850db5b6a4e59fad
SHA256

457046d9ae69be14e4a062bd15f74b584c999a596d6ff39e4f7868c3a243ccf2
SHA512

d14df38ad41c299b63a0d1d54dbd2be40eb80a1cf33135c087660b93fa90dcae3613a601c138f3bceaf185c8cbd72596fb222664be278ee0842ac9d66d268dba
SSDEEP

3072:o3ukXTNGp7+6zaEY7Zf/a0ye30zJhz8p2y:8TX8F8ECd/jOD8wy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2088	2108	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2108	2148	rundll32.exe	83
PID 2148 wrote to memory of 2108	2148	rundll32.exe	83
PID 2148 wrote to memory of 2108	2148	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ch\libipt-32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ch\libipt-32.dll,#1
  2⤵
  PID:2108
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 600
    3⤵
    - Program crash
    PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2108 -ip 2108
1⤵
PID:3588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads