939cdd940184fa0be3ac8de9330d66e144d93396098713278e736e6ab1396f72 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 09:56

Sharing

Report Analysis Logs

General

Target

spooferconfig.dll
Size

6.0MB
MD5

f553ad722875c02d5b45f5c975ceb771
SHA1

867f41aa5b67cf7e15e3efe6cb4360f8f415fa6e
SHA256

35f12093577d9c58fe7858ca26a935aaf409269057a9a8bdf975693d6dfe208a
SHA512

041924f9a64d626d1a3b7111de968f11cc08d384b9dcd47e832744bc195d71d6f58bf06cc9f14fcf31a2f1490230779d9a1afd70e8eb836424fd14d59e6f663b
SSDEEP

49152:Z9EWdahQOLgGyX6lRu6vz3ZLZh/qNwffAj3g/bTqSk6Fi0Lp5eo0Jvn:DaNFz3Z3/lgQ/6Sj5wv

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1708 wrote to memory of 1444	1708	rundll32.exe	WerFault.exe
PID 1708 wrote to memory of 1444	1708	rundll32.exe	WerFault.exe
PID 1708 wrote to memory of 1444	1708	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\spooferconfig.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1708 -s 260
  2⤵
  PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads