b5a7df1bce14af47db87f45e2ee5c2f53408d181da89d3490298e49714902a03 | Triage

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 08:52

Sharing

Report Analysis Logs

General

Target

MCoreLib.dll
Size

105KB
MD5

4bfe78733c40e09cc443262127c4ff6b
SHA1

2a872f216ca9f370d480894dadc7c99d555ab612
SHA256

3b42409060e78d35b0a4f832001e292483c5e8b28be58c7641682757b0af28d0
SHA512

152779fd1002a5de6970af21f27f589031fe7f3bfc4d5d295c4bbb5dd7526159e01ca67717afaf5a80af4142082c159d8cb4ad1d37e6f0b447b4635de5956f0f
SSDEEP

3072:HmDtTc70hIJAqgCLlgdkEZhxBOt/Dl1cwHjCp++:GpkYAgCLlkki7BOt/Dl1cwHjCp+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2596	2012	WerFault.exe	31

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2012	1876	rundll32.exe	31
PID 1876 wrote to memory of 2012	1876	rundll32.exe	31
PID 1876 wrote to memory of 2012	1876	rundll32.exe	31
PID 1876 wrote to memory of 2012	1876	rundll32.exe	31
PID 1876 wrote to memory of 2012	1876	rundll32.exe	31
PID 1876 wrote to memory of 2012	1876	rundll32.exe	31
PID 1876 wrote to memory of 2012	1876	rundll32.exe	31
PID 2012 wrote to memory of 2596	2012	rundll32.exe	32
PID 2012 wrote to memory of 2596	2012	rundll32.exe	32
PID 2012 wrote to memory of 2596	2012	rundll32.exe	32
PID 2012 wrote to memory of 2596	2012	rundll32.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCoreLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCoreLib.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 244
    3⤵
    - Program crash
    PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads