213345f0ceca25e87a4b6747686e32261d12a7ebe1daaebcd13887c70ca3c021 | Triage

Analysis

max time kernel
9s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 00:48

Sharing

Report Analysis Logs

General

Target

IDA-Pro-main/clp64.dll
Size

1.0MB
MD5

9551263c9dd81e8a42487718dbe1a17a
SHA1

9b048160efc67e8b2ef713933212edaedcb158a5
SHA256

5870149d7b091376e6a89d691a9ef4b7b889e3c3bf2516f8c7b73f6cf762fbc0
SHA512

bae732d98371157f764316e66f333d4362b0161b4a38650cc9eb23e3d01655b892b5fc86d99b45afc649257694a2cae6be563ac40193f4b546c7f36a0d31be36
SSDEEP

24576:w7Vt9qfawrN27U1izzZaRbfp81L/Wm/nd6Wrr+U/FQT:sBqfSU14Zadq1L/cWrrTFQ

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 612 wrote to memory of 2468	612	rundll32.exe	WerFault.exe
PID 612 wrote to memory of 2468	612	rundll32.exe	WerFault.exe
PID 612 wrote to memory of 2468	612	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\IDA-Pro-main\clp64.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 612 -s 84
  2⤵
  PID:2468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads