abfa585a5358e658bd92d159e9f846b2950c7e300c47392283443a1bcb70fd52 | Triage

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 01:08

Sharing

Report Analysis Logs

General

Target

FLEngine_x64_Copy1.dll
Size

60.9MB
MD5

8cf300dcb6e41ee31ed6a2b58d9e26d7
SHA1

7a5dc2917942d59dedc11bc861aafd58985debb7
SHA256

abfa585a5358e658bd92d159e9f846b2950c7e300c47392283443a1bcb70fd52
SHA512

ffff2eb3f0c654f7d761978202af5d8aa64806fc6d50bc75be619ebf5e078e4fb7263aba0959d9cb941f3f515c2ed3c0cd4d5f9bab5758b82825368a975b25c7
SSDEEP

1572864:kRaFRXuG/pEqk4Ldvts4T6wH1Wq5qgZhgUB:qIXbRtLsYL8Wg+

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2156	rundll32.exe
2156	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2156	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1984	2156	rundll32.exe	31
PID 2156 wrote to memory of 1984	2156	rundll32.exe	31
PID 2156 wrote to memory of 1984	2156	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\FLEngine_x64_Copy1.dll,#1
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2156 -s 112
  2⤵
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2156-0-0x00000000773D0000-0x00000000773D2000-memory.dmp

Filesize
8KB

Download
memory/2156-4-0x00000000773D0000-0x00000000773D2000-memory.dmp

Filesize
8KB

Download
memory/2156-2-0x00000000773D0000-0x00000000773D2000-memory.dmp

Filesize
8KB

Download
memory/2156-5-0x000000006F9F0000-0x000000007380C000-memory.dmp

Filesize
62.1MB

Download