c9ce81824cf19248b5e214d2d95b65b5a90bcacc6e9eac734e8fb397ea85c29b | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 07:31

Sharing

Report Analysis Logs

General

Target

2f98f3846d250fdf7f9f4e40b0b06750N.dll
Size

317KB
MD5

2f98f3846d250fdf7f9f4e40b0b06750
SHA1

2c83102746ffd7118f53bc8fd338199db19364bf
SHA256

c9ce81824cf19248b5e214d2d95b65b5a90bcacc6e9eac734e8fb397ea85c29b
SHA512

ed7eab8fc55e5709de557b37cbcdc766afc465a5384e3e66306f0d453919b4ccd96e318f57e97403f267ef662cac6f23e8eaf5b186fad5e4dd1a982b4bf6427b
SSDEEP

6144:na+xhNk9WViitUljCuISt4bfhDhaohEGQ7H:nNk9WViitUlWuITfuoI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2384	1732	rundll32.exe	30
PID 1732 wrote to memory of 2384	1732	rundll32.exe	30
PID 1732 wrote to memory of 2384	1732	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f98f3846d250fdf7f9f4e40b0b06750N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1732 -s 80
  2⤵
  PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads