bb227aa7b0404ccac254372c91ddf2e307526aa82ed9c4ecd3e495c38a6b4552 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15-07-2024 08:31

Sharing

Report Analysis Logs

General

Target

MedicareSign/hatls.dll
Size

2.1MB
MD5

bccf6a5c2595eea84533692bb788d8bb
SHA1

24318226f145e52b7633a4e9e844d6ead43b75ac
SHA256

abf75de674428e112f90f1c618218ff73ef851f4f09c5f5ba8b69e79a6c74dbf
SHA512

78f24f0812aae31e83340adeb1a1ae8c00edfdf483e299706f863cb713bfdc2501b5418ce8f8bd9131e3c704bffb58a8ca05c5e0a75eb19f15e0409c5b74e35b
SSDEEP

24576:2HGHuX4EewGQcPryfFMoxJ+4PulW/ChEIgTS/zRUm:2HGOX4CGQtMs+WuVge/em

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	3216	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3216	3788	rundll32.exe	85
PID 3788 wrote to memory of 3216	3788	rundll32.exe	85
PID 3788 wrote to memory of 3216	3788	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\hatls.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MedicareSign\hatls.dll,#1
  2⤵
  PID:3216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 620
    3⤵
    - Program crash
    PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3216 -ip 3216
1⤵
PID:3584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3216-0-0x0000000074CB0000-0x0000000074F9E000-memory.dmp

Filesize
2.9MB

Download
memory/3216-1-0x0000000074CB0000-0x0000000074F9E000-memory.dmp

Filesize
2.9MB

Download