609e38e067e3a764cb62d60c911b42d8c617c9ce622afdc308fe09327e248d9c | Triage

Analysis

max time kernel
104s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 01:32

Sharing

Report Analysis Logs

General

Target

bin/clrcompression.dll
Size

730KB
MD5

81ef5fb2e7ad2e8e39f913b316831c02
SHA1

6b473546afadd7dc4e27a0d8607a0c4068cc5eeb
SHA256

dfef1cf457f13abe9336baa10e4efdc8d3308d90515f62848f29c8b4ace2d4bf
SHA512

1e4218a5e6bab9e35b890b7eb24d6d4c0f4614f867ffbb1a4e855bcb8af6e83b0419083300eb25229a7382df3fc4b52af0ac28e2d2976fa54abf9db510b69d52
SSDEEP

12288:pTQ2AED8dhkvT6vSC1T1KPAHhlyRMh8rXTw05nmZfRm:JHAEAdLvdTMPA+pwAmZfRm

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1428	1704	rundll32.exe	30
PID 1704 wrote to memory of 1428	1704	rundll32.exe	30
PID 1704 wrote to memory of 1428	1704	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\clrcompression.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1704 -s 84
  2⤵
  PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads