c5cbfde3efbf5f93df14eb9110e9d747a966f74278c9cbeab6f875607009459e | Triage

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 21:00

Sharing

Report Analysis Logs

General

Target

1gbwwte3logn.dll
Size

11KB
MD5

558a057a766736289b2da31eab04db53
SHA1

ab48d1f8acdae775a154566fe7152c04eb6a7d1b
SHA256

b4607d330754a557a009ce50c3ab252743b269fca2fa99500ec58570e393b699
SHA512

d582be64cd5edf6fe608a25cb8661c5e97502b2afe817d6b3c8f7144c8c1e078afb94ce826c4bbdc35ee72cc7702d4920e00da02021418465856cd460a81d79f
SSDEEP

192:y6c4E4WP2CoNuLlnZg8aMFfzVA8G63kI0hKLgpn+t3N:KbBnLle8aMFhtGiF07pK

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4336	4204	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe
4204	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4204	2264	rundll32.exe	83
PID 2264 wrote to memory of 4204	2264	rundll32.exe	83
PID 2264 wrote to memory of 4204	2264	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1gbwwte3logn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1gbwwte3logn.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 672
    3⤵
    - Program crash
    PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4204 -ip 4204
1⤵
PID:4408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4204-0-0x0000000075260000-0x0000000075267000-memory.dmp

Filesize
28KB

Download
memory/4204-1-0x0000000075260000-0x0000000075267000-memory.dmp

Filesize
28KB

Download