5dde351516155c3ec5f77c4b93018609d6beeb642a03f12d5da30f0e1ca9d410 | Triage

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 06:46

Sharing

Report Analysis Logs

General

Target

CommonSpecialist.dll
Size

150KB
MD5

26dc5b273d817257941ef9264129736a
SHA1

8b120b6f966b76e57f7af4e7245f66241f5fc38b
SHA256

63bf8ea19ff5e70b7a3b69f280b771cce39b4c0cef449bd8ba2c8c6de1c8fb1e
SHA512

011f3b9d02145bc7c17f47cd22ef67667c71a3217246c4c1bad6f59ea34bb4d1acb44fc50c86158d1a56bd07693466bd401d2af2b01370338d3c37c17b7fc8cf
SSDEEP

3072:eLgfRn1L3ZvyE9/VZCzyOuB780R/TFraZP0Err:tpn1L3ZvrFVwzyOuB780lTcZPnrr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3124	4500	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 4500	3436	rundll32.exe	84
PID 3436 wrote to memory of 4500	3436	rundll32.exe	84
PID 3436 wrote to memory of 4500	3436	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonSpecialist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\CommonSpecialist.dll,#1
  2⤵
  PID:4500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 596
    3⤵
    - Program crash
    PID:3124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4500 -ip 4500
1⤵
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads