089b9af9ccab56dc15339777ed6435b0aa9d12f1f50481a5342dbd61c4264da5 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 06:39

Sharing

Report Analysis Logs

General

Target

LGBeanClean.dll
Size

265KB
MD5

702afd7cd174dd5630797bca9f638396
SHA1

d1e614cb6c50e2dfc7375095117adf0198ff3829
SHA256

6003095937a0ba9e9d0ca73c0f4b6bb18fafddf81bc6d26085b527b78ab404c3
SHA512

89c968cee37071c056bcbb20a6ed5b916f7bea83d757a51b0eb19d7c3032d325c218dda2813f85b65f845cd5f9d01122899a2a39baedacc66b28c8a4cfbb700a
SSDEEP

6144:paOA+RgnJhDYl0Sl07nUfHwBCqTSO2QcpERZY:pVRkJRY6UfHSCPO2Qcpb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4984	4808	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 4808	3968	rundll32.exe	84
PID 3968 wrote to memory of 4808	3968	rundll32.exe	84
PID 3968 wrote to memory of 4808	3968	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\LGBeanClean.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\LGBeanClean.dll,#1
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 644
    3⤵
    - Program crash
    PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4808 -ip 4808
1⤵
PID:2400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads