5dde351516155c3ec5f77c4b93018609d6beeb642a03f12d5da30f0e1ca9d410 | Triage

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 06:46

Sharing

Report Analysis Logs

General

Target

RegHookSpecialist.dll
Size

135KB
MD5

bc0d79e8a7d66f61d144bdaba9f21c4e
SHA1

f79057485bf1d4dbf59039a6682f1c3459de87a8
SHA256

e562086d730661316e8195013109ca305dbb0a07f4a0ab3965daad6fab5a7166
SHA512

0effdb356df6f854f3dee8814c4f8737047422670a02db1f6a86bd1bfe544d32b66d0910c18e40b008672412e535dc3dcbba92e2cea552217382c83d97e60534
SSDEEP

3072:arxH+fulSq6qEfTvyHoBbnS4frBdZoJBLvPAY:arxH+fulSqlHHqbnSyfZoJxoY

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8	468	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 468	4864	rundll32.exe	84
PID 4864 wrote to memory of 468	4864	rundll32.exe	84
PID 4864 wrote to memory of 468	4864	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\RegHookSpecialist.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\RegHookSpecialist.dll,#1
  2⤵
  PID:468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 608
    3⤵
    - Program crash
    PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 468 -ip 468
1⤵
PID:4696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads