ba2f2e8f23015035d16be8378c5e30d42b8a6419dae1a9f50ddb0a358175a159 | Triage

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 13:40

Sharing

Report Analysis Logs

General

Target

App/ProgramFiles/libexpat-1.dll
Size

139KB
MD5

701659d3689bf4a8265b669b7d774255
SHA1

ab32887ca7a9f1601eef4910954e023cfb1b2075
SHA256

f2e500f501c03d3d09609c6d0b2ea4c51bb433762d9c8f82ac6163877a780bc8
SHA512

34df12fc988cc12e50e2c046ecf1427b0413cd6d5721847c99aa31f91f4aee7b171956776431ed362fb60b2dcc2c082a3d44abb377f5c2bc5c7db67ad26fe4e1
SSDEEP

3072:m2XuGUTjoT7s/w1EPkTDzhPJJTVel4ZYGwwwwFUcgP8:bwT8lVjJJ4y

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1584	3144	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3144	2728	rundll32.exe	85
PID 2728 wrote to memory of 3144	2728	rundll32.exe	85
PID 2728 wrote to memory of 3144	2728	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\libexpat-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\App\ProgramFiles\libexpat-1.dll,#1
  2⤵
  PID:3144
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 600
    3⤵
    - Program crash
    PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3144 -ip 3144
1⤵
PID:3888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-0-0x0000000068F40000-0x0000000068F63000-memory.dmp

Filesize
140KB

Download