4d8a1e2d043ac44781bd61fe99f089084b24afd490065f0a7987a68ace788237 | Triage

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$_14326_/Auth.dll
Size

233KB
MD5

05bb684b29e4a21bc02da260eb809457
SHA1

1acae3dac0bcb4a35e8ea91f1960bd9272d0062d
SHA256

ed05b1f7a9fb0db8e15fb43a808d619b4cb92cd12c9fa35147fe4e3d68c60780
SHA512

b097a3ab6d2e1323e93ccac40c5b07071f095733b2b7dc00fc41d8ff2b15335db9e9862962e0b50a1ca817059fda4c2fb576d9ebb60e60bd7c19696ae963bdd8
SSDEEP

6144:4kVBkZBaEPAQAJCzV2TLWu+yiyUsziukOChC878uBuHfOfY6En6T2TSCOCOdNXNc:FuPnV2P

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1540	336	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 336	4924	rundll32.exe	84
PID 4924 wrote to memory of 336	4924	rundll32.exe	84
PID 4924 wrote to memory of 336	4924	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_14326_\Auth.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$_14326_\Auth.dll,#1
  2⤵
  PID:336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 600
    3⤵
    - Program crash
    PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 336 -ip 336
1⤵
PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-0-0x0000000061440000-0x000000006147D000-memory.dmp

Filesize
244KB

Download