64f0803dc343b57b1f9114f1bfb9eeacf9d76b193620621561a280827b0b6326 | Triage

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 19:05

Sharing

Report Analysis Logs

General

Target

402323332/Files/isbzip.dll
Size

36KB
MD5

e43abb7be44beabca7b75bf25b022cac
SHA1

69c78415a377dbeb2d1dd8c37863c2aeff3e9d61
SHA256

d49058b388f75915ad89a7911caff47f024f4e9204b07c67fcdd7015ac69e9e7
SHA512

58a215adf97dc25ecb74b1bb2e960cca1fd61c04b6b2adfbf585383847f2a1d0fa0cfda542fa49a7fb501be9a52b544647055715d617c0c0ceb2bb23130ba6f4
SSDEEP

384:sMbaCLHqFXUt9EKjIv9OY8pSehac8oI7VzEyZ97e5QDpRPtAsLiA:3uDlIpL+VwC7htN23A

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	5060	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 5060	1436	rundll32.exe	83
PID 1436 wrote to memory of 5060	1436	rundll32.exe	83
PID 1436 wrote to memory of 5060	1436	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\402323332\Files\isbzip.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\402323332\Files\isbzip.dll,#1
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 600
    3⤵
    - Program crash
    PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5060 -ip 5060
1⤵
PID:3968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads