816678f27a605539befc4304ad9d82a8b95a6292180616de67b5861e0cd0a44e | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 03:27

Sharing

Report Analysis Logs

General

Target

Isdjek.dll
Size

10KB
MD5

736d1bc5cb5ad0af70d6a94b768f2803
SHA1

5cd2f1e890d3f493dc61c05130c8ca2979ee0bb4
SHA256

1bba6e6e13f028e67d529d52e3614b607536f718b5d8e0aa6cd98f1aa15101b7
SHA512

909e33ffdbbe3c6f797e3eea14d5722addbbe3e5c9cb085dc2edbd8d69942de3d6dd58a57f5476a5e255b80b50869a516814b1b9791c388a2fb7749ca246cbff
SSDEEP

192:aM4myTKvnKiCON7bop/HuOaAn6MsdHGlK3cn84M2Wk7I9Hb2t:2rmCCopWO7nBnlGc8I7I9H

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4392	2976	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe
2976	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2976	2872	rundll32.exe	83
PID 2872 wrote to memory of 2976	2872	rundll32.exe	83
PID 2872 wrote to memory of 2976	2872	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Isdjek.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Isdjek.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 696
    3⤵
    - Program crash
    PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2976 -ip 2976
1⤵
PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-0-0x0000000075090000-0x0000000075096000-memory.dmp

Filesize
24KB

Download
memory/2976-1-0x0000000075090000-0x0000000075096000-memory.dmp

Filesize
24KB

Download