0d60bc587b5e80c03345dff692b6de492dee7bd946f2522086a00992e9561757 | Triage

Analysis

max time kernel
88s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 08:18

Sharing

Report Analysis Logs

General

Target

HTTP.dll
Size

880KB
MD5

5a6b7a8ae37bd608c0dd3d7748894aa8
SHA1

168761807660b912aead8cd8f23ca7021ad9faaa
SHA256

9c748bd1a326c6a7a48c51738ad265baf09cf19ff41dd6cfb4a42cf633cff80f
SHA512

1b0e3b02fbeaf6fe020f23505095aed9a61f2556b5dce4fa773a0c6f0bda973c7dc2ef243f06d7eecd0fc6db2d381bae61c9368dc6a93ba0ddee169e635f1db3
SSDEEP

12288:Snfl4vO4HyKiH4J0GJNwwpv0wwqSqdxqyAuDk6QjRNmIt8PHu:Sf6O4ziYJpNDpv/DPgRVKO

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4148	1068	WerFault.exe	82

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1068	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1068	1528	rundll32.exe	82
PID 1528 wrote to memory of 1068	1528	rundll32.exe	82
PID 1528 wrote to memory of 1068	1528	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HTTP.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\HTTP.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 692
    3⤵
    - Program crash
    PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1068 -ip 1068
1⤵
PID:3480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads