7c5b449226d2c3e8e65341baffb10b9393282d53b7f6fb164ed788ca2967bb99 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 23:59

Sharing

Report Analysis Logs

General

Target

bin/libgcc_s_seh-1.dll
Size

147KB
MD5

25d035933434a273b7916e6eb443d3b6
SHA1

f829301691214d24f6d989e7c948ffa8d8d64c37
SHA256

b22b954397a52703579d92db64b57812af70f2afcafe2e742a009c1640b9ec1a
SHA512

e3c1620bc24ea117279074ee01810e99be342649add6a80728b42ffc06e223e9eb65f16f6632ccec93e96f880304536a1b8dd4f0ac8c2ead1550290e11cea1c0
SSDEEP

3072:N8TG1KpEDJZkSjJDKW2R8cd6PM+MahQocoERNyN8B4M0F2:xKSjjJOBRw0bo0yo90F2

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2852 wrote to memory of 2756	2852	rundll32.exe	WerFault.exe
PID 2852 wrote to memory of 2756	2852	rundll32.exe	WerFault.exe
PID 2852 wrote to memory of 2756	2852	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bin\libgcc_s_seh-1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2852 -s 84
  2⤵
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2852-0-0x000007FEF7910000-0x000007FEF793C000-memory.dmp

Filesize
176KB

Download
memory/2852-1-0x000007FEFB8B0000-0x000007FEFB8C6000-memory.dmp

Filesize
88KB

Download