d3cf785008a467e4ddc26f49f711d6cc3cffc986ac83bdce58f3fec83046df36 | Triage

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 03:00

Sharing

Report Analysis Logs

General

Target

$0/questbasic.dll
Size

868KB
MD5

3ce2d49509c3c0b6ebfdc47c743840f3
SHA1

8f04e2d9b41561821f58fd72a99c13a15a1a2aa4
SHA256

0143382a5b3f4148aa6fb89b97a50dc8ce199ee0c0bdcc1ba419a4c5b63d9dca
SHA512

fb831716ce1db52b8a0b9a38d2a176edf5751618443071e263da119ea502de7be0145dc3a65d01103b81cee1528a844c7ec6cde20de21d87644dde153bc38f57
SSDEEP

24576:04wisA7GA1zgECFzi/3qhaTxRo8hS8NYc1:BwisqXb2ycaFRo8RWc

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3376	352	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 352	1004	rundll32.exe	82
PID 1004 wrote to memory of 352	1004	rundll32.exe	82
PID 1004 wrote to memory of 352	1004	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\questbasic.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$0\questbasic.dll,#1
  2⤵
  PID:352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 600
    3⤵
    - Program crash
    PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 352 -ip 352
1⤵
PID:3188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads