0414a6fdd97c981dda46079df82406d575ce95b45c649ef3dc35ee83c896460a | Triage

Analysis

max time kernel
94s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16-07-2024 01:04

Sharing

Report Analysis Logs

General

Target

40e6839c717a308e77d88808e74ea030N.dll
Size

70KB
MD5

40e6839c717a308e77d88808e74ea030
SHA1

60ac8c1b0e7736c7c33d0f94b605d51f20527aa2
SHA256

0414a6fdd97c981dda46079df82406d575ce95b45c649ef3dc35ee83c896460a
SHA512

7fbcbe1eb6ff7489f83d6021ed0d4047e67b26b571d5e61539b9da927dccf135249ddf098a80825c1818a903cb81e045b6aff7ac6868c6a7752f9e7a3b9c7523
SSDEEP

384:IcoG+Wxrb8YkvJnmG7jQPsXdqiV+IjX8FFe:IcoG+WdRImdF6Xz

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3972	1772	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1772	2544	rundll32.exe	84
PID 2544 wrote to memory of 1772	2544	rundll32.exe	84
PID 2544 wrote to memory of 1772	2544	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40e6839c717a308e77d88808e74ea030N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\40e6839c717a308e77d88808e74ea030N.dll,#1
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 608
    3⤵
    - Program crash
    PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1772 -ip 1772
1⤵
PID:3140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-0-0x0000000075600000-0x000000007560F000-memory.dmp

Filesize
60KB

Download