96a8b48d4ea92434412972afca47aee890254257e729795819bf34597b614751 | Triage

Analysis

max time kernel
141s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 18:14

Sharing

Report Analysis Logs

General

Target

crack.dll
Size

2.3MB
MD5

b20aea020a8614176072da7b04296d22
SHA1

1508768117167ef69cd5c4182097304f520f9d9b
SHA256

5607f154872d0ba75144e05dc1a507a37d2e3856d6670cfe04dc7b0ec7597d9f
SHA512

3d1255e3f5e75957ada4eca53c3616b09a776bbaec5b80b530312503a1606f10768ad4dc0c2d6911fd4b9b3dbe79c016afff2785b5ddd52f8b057fee0126558d
SSDEEP

49152:5x9V/Kjom+KbrSFV3X/YCYp5WefdmjLdGGf:Aom+KbOYCYppfdmjLdGGf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2336	2300	rundll32.exe	29
PID 2300 wrote to memory of 2336	2300	rundll32.exe	29
PID 2300 wrote to memory of 2336	2300	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\crack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2300 -s 68
  2⤵
  PID:2336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2300-0-0x0000000063340000-0x000000006342D000-memory.dmp

Filesize
948KB

Download