34e141c88f20dffe25bf118a427415ce55cbc123848a2f6d2d5ccfe390a746ec | Triage

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 17:22

Sharing

Report Analysis Logs

General

Target

Wave/CrackedWave/bin/xxhash.dll
Size

45KB
MD5

161bd3d60228dd16c54a927250af3e49
SHA1

463243c3cc2e0bca16f3ced2c3b70c13a0e97fa6
SHA256

ecb5aa2bf0ff355a7b36bb3a991264655e13e0f2c9e88b9dfa39d7fe4c5142a7
SHA512

3716ce34c1e9931007f374685a6588bc355e942872e7a42eaa4c5be9a0fdc93f081a1dc5c3d8fec4a4563dbd556f4d046f7bf3d50840c02d8aa822eaca7a577b
SSDEEP

768:I9otvM7DZ1LMDJdj+LVvgFlJus4zBOQdlyR0/A:I9UEDLMDJxKM0scUS

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2540	2424	rundll32.exe	30
PID 2424 wrote to memory of 2540	2424	rundll32.exe	30
PID 2424 wrote to memory of 2540	2424	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wave\CrackedWave\bin\xxhash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2424 -s 80
  2⤵
  PID:2540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads