b5a7df1bce14af47db87f45e2ee5c2f53408d181da89d3490298e49714902a03 | Triage

Analysis

max time kernel
134s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 08:52

Sharing

Report Analysis Logs

General

Target

MCoreLib.dll
Size

105KB
MD5

4bfe78733c40e09cc443262127c4ff6b
SHA1

2a872f216ca9f370d480894dadc7c99d555ab612
SHA256

3b42409060e78d35b0a4f832001e292483c5e8b28be58c7641682757b0af28d0
SHA512

152779fd1002a5de6970af21f27f589031fe7f3bfc4d5d295c4bbb5dd7526159e01ca67717afaf5a80af4142082c159d8cb4ad1d37e6f0b447b4635de5956f0f
SSDEEP

3072:HmDtTc70hIJAqgCLlgdkEZhxBOt/Dl1cwHjCp++:GpkYAgCLlkki7BOt/Dl1cwHjCp+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3952	5072	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 5072	3272	rundll32.exe	86
PID 3272 wrote to memory of 5072	3272	rundll32.exe	86
PID 3272 wrote to memory of 5072	3272	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCoreLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MCoreLib.dll,#1
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 644
    3⤵
    - Program crash
    PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5072 -ip 5072
1⤵
PID:3372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads