2d280b703f567beb3f4dd5d80233cd41b231826451a83157d75f93097a0c6490 | Triage

Analysis

max time kernel
93s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 15:02

Sharing

Report Analysis Logs

General

Target

MSVCRT.dll
Size

272KB
MD5

0a8e038a03d7e409e5140fc9222af3a8
SHA1

afc924038bc8364f7816bfd4830b321ec1b78f6a
SHA256

babbfb63bb9ddd3763a5f528e3c438a590c7cb63d75ac4da7d1cdd0f7a107d0c
SHA512

4a9cfabb8e45e1b41e80913d956a18405a6d3068930ce59177e2908360ff2e5ff311573fe22e541c65ad3e81991ab9634d81b0c653e2e5ee1eb26bee257cafbb
SSDEEP

6144:HzKmr0FjgoKL1fpEMhQLT53t+C/23A4hzWoFMWiFaNF7R5LPXSQj3:TKmwFEL1fpEMh8TJt+GIzh5BqQ7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3696	324	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 324	3500	rundll32.exe	84
PID 3500 wrote to memory of 324	3500	rundll32.exe	84
PID 3500 wrote to memory of 324	3500	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSVCRT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MSVCRT.dll,#1
  2⤵
  PID:324
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 600
    3⤵
    - Program crash
    PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 324 -ip 324
1⤵
PID:60

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads