910bc0e0e5afd7669cfd1932606e30484751c5cd8de63d37a39716bc039c5317 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 17:11

Sharing

Report Analysis Logs

General

Target

setup-x86_64/Cryptodome/Cipher/_raw_cbc.dll
Size

12KB
MD5

9717fb30ef626e6afdb2841b09e992b9
SHA1

41cde70e45caee67c16ec2f85a252ee9ec0382f2
SHA256

1cb0883d470bf0f24bcb563bd9c247bd63659f6a224bd961b9368a20589e8197
SHA512

ae7d38cc9930bdb04128eb79d1de5d4f1e1e32fb6a98f5aa66775919399d471ff010b61e30c7d08446b141e84059047fa2fefc1d0ac58583294f0a99d6cdda76
SSDEEP

192:NF/1nb2eqCQtkrAUj8OxKbDbHecqgYvEkrK:52P6EE8OsbDqgYvEmK

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2100	2972	rundll32.exe	30
PID 2972 wrote to memory of 2100	2972	rundll32.exe	30
PID 2972 wrote to memory of 2100	2972	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\setup-x86_64\Cryptodome\Cipher\_raw_cbc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2972 -s 80
  2⤵
  PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads