7d782ba8db8958ac564a7d2e7ba41dc0f05520684c5181b4913b43f1b5eb709b | Triage

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 03:07

Sharing

Report Analysis Logs

General

Target

b3tnt2.dll
Size

1.2MB
MD5

12333ffb14afb459e773fb1e8bcfcc66
SHA1

30f16ece1dd41d9007981d6224b328b4aa03d5d0
SHA256

7d782ba8db8958ac564a7d2e7ba41dc0f05520684c5181b4913b43f1b5eb709b
SHA512

7b362addbf01a613b0179334fdd4f2692c9da5c98743acc63aa00dcc0b3a779647f387256fea227dbb61eeeb6d28dc87d470f25e2d8c5c6cc0288e4b52adf9fb
SSDEEP

24576:+Kls2NcaWYadG7oU6O9vgDjQw77otvhUCWkuPCr:+YNcaFadG7oULvgHQwHoJ6fkuPCr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4652	4768	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3460 wrote to memory of 4768	3460	rundll32.exe	84
PID 3460 wrote to memory of 4768	3460	rundll32.exe	84
PID 3460 wrote to memory of 4768	3460	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3tnt2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3tnt2.dll,#1
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 616
    3⤵
    - Program crash
    PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4768 -ip 4768
1⤵
PID:2496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads