534daabef37aaaabc0be8c9bc86eea06855a269189d117a091f4a111a6f4c89a | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-10-2024 06:39

Sharing

Report Analysis Logs

General

Target

HLLib.dll
Size

219KB
MD5

f992cbc53a0469cfe021d3504bfea99d
SHA1

7f74ea1dfec9a28928558778bca6fa95d67768c3
SHA256

a6639ecc03e1052e9e0de76dd5ad4dfaa81cf9d3ab931b4c59799407bbdcd0dd
SHA512

c1c3e667101322212798291bb9a8ad42d989beae5115939744efa1c547988d655ed57b23e67a53fbb968364a42ddffd4a35cdf0f50340f7bbdfc67595bdade2e
SSDEEP

3072:Xmz3+EYmKFC+9x8VSZick2Oi1y4TBfkFUTr5bc5KpY2OlyLhKDtRuHxx:XmD+4KAcxbZy2Oi1y4TBMyv5FXOlZ4

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1576 wrote to memory of 2364	1576	rundll32.exe	WerFault.exe
PID 1576 wrote to memory of 2364	1576	rundll32.exe	WerFault.exe
PID 1576 wrote to memory of 2364	1576	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HLLib.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1576 -s 80
2⤵
PID:2364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads