d7c848cb1d933b3d05b745a8a88807e3a14eb57aff497f553faa8ec9597ce989 | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27-08-2024 03:39

Sharing

Report Analysis Logs

General

Target

libmmd.dll
Size

4.0MB
MD5

42943c6acaf8d5ca953911b2bb99fc14
SHA1

ea719eafd2857b43b20228827f5596f1137ac3d5
SHA256

427ef018d494bf6cb8531ab3bbcb501ed4c8c7c6479097b33ab4d15750eccc4c
SHA512

85e71abc6db8a2e4eaad70d35ca613a918046715c8447b4c975021791f160aa3d1c4cb19969f81dd7b9f98f13dec41619c44e3c5948ae593af9c3d0cfec346fc
SSDEEP

98304:FJLi7X0J2iGkPyxtHzk8joEGIbQOpv3VzGSsJQQq:nyqCtH48UEtb5ySs2L

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2692 wrote to memory of 2748	2692	rundll32.exe	WerFault.exe
PID 2692 wrote to memory of 2748	2692	rundll32.exe	WerFault.exe
PID 2692 wrote to memory of 2748	2692	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libmmd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2692 -s 80
  2⤵
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads