fda6b5f03b8fbcf70b9b336ab9bb42b45b3a66911bdee538f5d074724177ba55 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12-08-2024 03:30

Sharing

Report Analysis Logs

General

Target

Wind/xxhash.dll
Size

45KB
MD5

fd4a9c28c2b7b7f7cae985eed789f0ce
SHA1

44b51dd9a141f3dfcc090549e6c90071f8b55fb4
SHA256

dc354e7ea9046cadbed8645e4666975a523463500c877574f8e8306d958b7304
SHA512

b3ae3d523a1a2de93f05cfa856ac6984d444ee5180f862f0046be3acd02fb499400909449c7e47f764aea2d7d3863e42c7029b0cfc8803b79a91c9f56f3b8bc1
SSDEEP

768:f9otvM7DZ1LMDJdj+LVvgFlJus4zBYdXK3QDV:f9UEDLMDJxKM0scCXKA

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2980	2824	rundll32.exe	30
PID 2824 wrote to memory of 2980	2824	rundll32.exe	30
PID 2824 wrote to memory of 2980	2824	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Wind\xxhash.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2824 -s 80
  2⤵
  PID:2980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads