5188c69bd772ebe6ca8b34e8c08eec90f63ffcf1d6ab20287e074732da21076a | Triage

Analysis

max time kernel
145s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15-07-2024 12:16

Sharing

Report Analysis Logs

General

Target

jet/crack.dll
Size

2.3MB
MD5

10f5e8139433eb7087c7946c0659cdf2
SHA1

a5ed6ad5115e3d1a9b274d5132ee51d94ccdf568
SHA256

031ba5a69b202f5d7a5dccb8fe7795aa711acdcf9d122e776f08badfd24a510e
SHA512

413638b28320378930c33726246eae113925e7034d05503d4e0277402c600f850f8d96d0c259925d7dcac1abb12353c0935dec7f466013d523bd4075be621d48
SSDEEP

49152:XwFdjXhom+KbllCmGFZYCY+DWefdmjLdGGf:4om+KboYCY+TfdmjLdGGf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 760 wrote to memory of 2404	760	rundll32.exe	29
PID 760 wrote to memory of 2404	760	rundll32.exe	29
PID 760 wrote to memory of 2404	760	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jet\crack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 760 -s 80
  2⤵
  PID:2404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-0-0x0000000063340000-0x000000006342D000-memory.dmp

Filesize
948KB

Download