76067070bab280a36882fdb7bb7d7b79498d1f060c2da51e17833b94b19acb21 | Triage

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 18:42

Sharing

Report Analysis Logs

General

Target

bin/cgraph.dll
Size

74KB
MD5

dc2f0ae91c373f7310e8271b65458057
SHA1

092a944822b4fe697e88d809fe5dc6f40917f9ca
SHA256

47c91d9d91656376b8cc1a12d9976f36207141382d5cc940a8d2308ac3466577
SHA512

81d6d0d549c7c55d4167fc20f62a8f1ee5f0ca939783bfe99e9bf5c9d0cad525a9ea2c66d3df8da630d817eff38f22b7fc12c3138f9cc49fb0376e5fa5837a7b
SSDEEP

1536:IGDct/IhbADdeu28u3Ko1T2KOzaewL9F03LzTpWnRP30Cxknrwws:IGDM/IhbYetXbTJOugzTpWnRP37xknr

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 3032	1312	rundll32.exe	31
PID 1312 wrote to memory of 3032	1312	rundll32.exe	31
PID 1312 wrote to memory of 3032	1312	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\cgraph.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1312 -s 80
  2⤵
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads