5188c69bd772ebe6ca8b34e8c08eec90f63ffcf1d6ab20287e074732da21076a | Triage

Analysis

max time kernel
142s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 22:30

Sharing

Report Analysis Logs

General

Target

jet/crack.dll
Size

2.3MB
MD5

10f5e8139433eb7087c7946c0659cdf2
SHA1

a5ed6ad5115e3d1a9b274d5132ee51d94ccdf568
SHA256

031ba5a69b202f5d7a5dccb8fe7795aa711acdcf9d122e776f08badfd24a510e
SHA512

413638b28320378930c33726246eae113925e7034d05503d4e0277402c600f850f8d96d0c259925d7dcac1abb12353c0935dec7f466013d523bd4075be621d48
SSDEEP

49152:XwFdjXhom+KbllCmGFZYCY+DWefdmjLdGGf:4om+KboYCY+TfdmjLdGGf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1924 wrote to memory of 2396	1924	rundll32.exe	WerFault.exe
PID 1924 wrote to memory of 2396	1924	rundll32.exe	WerFault.exe
PID 1924 wrote to memory of 2396	1924	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jet\crack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1924 -s 76
  2⤵
  PID:2396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x0000000063340000-0x000000006342D000-memory.dmp

Filesize
948KB

Download