ed2a5bdf1a40aa83b5c918cfa5bd8bc5b8cf1216ffc3cc1a88de011e696c774c | Triage

Analysis

max time kernel
103s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 05:04

Sharing

Report Analysis Logs

General

Target

57090bcbff67d9b878d2633c788e3b50N.dll
Size

37KB
MD5

57090bcbff67d9b878d2633c788e3b50
SHA1

e8d338dd20761aa4a7c263884a82765065b96dbc
SHA256

ed2a5bdf1a40aa83b5c918cfa5bd8bc5b8cf1216ffc3cc1a88de011e696c774c
SHA512

fd9fa45b96920cf3e85fb355bff9a757c0b4ae90750f6f4907f435536cf467dc22f0baecd78fd08ca96706d60837027e0afbbdd0fab7206998684a0a83e2eb23
SSDEEP

768:KKWeQCCnORymIEVIqhb+f3KH0EDVnuBpyLFN:jWeQCCORsWb71DLFN

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1132	4480	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4480	3404	rundll32.exe	86
PID 3404 wrote to memory of 4480	3404	rundll32.exe	86
PID 3404 wrote to memory of 4480	3404	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\57090bcbff67d9b878d2633c788e3b50N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\57090bcbff67d9b878d2633c788e3b50N.dll,#1
  2⤵
  PID:4480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 600
    3⤵
    - Program crash
    PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4480 -ip 4480
1⤵
PID:4148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads