a3a264617e3ef583f7a8e9747ad08da7c5e831ee25eb597543512ae32ddf628c | Triage

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 19:00

Sharing

Report Analysis Logs

General

Target

api-ms-win-crt-filesystem-l1-1-0.dll
Size

22KB
MD5

1193f810519fbc07beb3ffbad3247fc4
SHA1

db099628a19b2d34e89028c2e16bc89df28ed78f
SHA256

ab2158fe6b354fb429f57f374ca25105b44e97edcbdc1b752650d895dadd6fd1
SHA512

3222a10c3be5098aca0211015efe75cfbcd408fd28315acedd016d8f77513f81e207536b072001525965635da39c4aae8ef9f6ad367f5d695de67b1614179353
SSDEEP

384:W3q6nWm5CpWfhWNLm0Gf3Jl0huSwJ+Ruh91MgKlx+YV:l6nWm5Ce4RVheJUUwg8V

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2796	2776	rundll32.exe	30
PID 2776 wrote to memory of 2796	2776	rundll32.exe	30
PID 2776 wrote to memory of 2796	2776	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\api-ms-win-crt-filesystem-l1-1-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2776 -s 80
  2⤵
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads