d33bf91b11f6b1322724aaf76a5f0564285b990833a7d2877917446a9c8b30ae | Triage

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 02:45

Sharing

Report Analysis Logs

General

Target

Cryptodome/Cipher/_raw_ctr.dll
Size

14KB
MD5

ca7908c37eed2f5581ea3664a8dec104
SHA1

ba390d3f1eb7481a73bd72632336f7a81db62c86
SHA256

31cbb026d183e8bfc4a6b8e777c446f978671ea2c012fd21b0a8160b2fc568b6
SHA512

48d9d75a9afc5eccd962036389e631440f7ab40568f9edd96dc931f584673d9f92495af095bc56004a427bd42c9b8fc32740d2c329a312af83f10e4e2160de1e
SSDEEP

192:ECf3gWtFziJM87vAxEN/eLU/ZM7E6txffDKPu6+6g:ECfsJM87YqScMJxffDKPVl

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2716	2680	rundll32.exe	30
PID 2680 wrote to memory of 2716	2680	rundll32.exe	30
PID 2680 wrote to memory of 2716	2680	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Cryptodome\Cipher\_raw_ctr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2680 -s 80
  2⤵
  PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads