d32298f1f5afdd3cd03e29ba3fd08787b346bf6ab7fa9296e6bbe2aaff40470c | Triage

Analysis

max time kernel
1563s
max time network
1567s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-11-2024 17:20

Sharing

Report Analysis Logs

General

Target

kg_patch/windows/ida32.dll
Size

4.4MB
MD5

7c9ee7bc31f24df6834d875f2c41e889
SHA1

1600ff7f49f5f46198489a87b9802d648c3c3e4c
SHA256

8ab79c98e7207832f4ecd0e031dbcf2ffee07c3efd58c94fabdfc5789a9bbe28
SHA512

a9da9bf4a26b1802434e799504f4d002270458fe9816dd190acf594e1dfda24016f5de6870ed6efc93b1f6ba04edfac50b1e65079f704950e83a9028e5b82227
SSDEEP

98304:JIVJmgZGXLWHFXF3hVfJKV1KwOS5ywJH5HimN:iVJnZsLWHFBhVfJKV1KwOS5vJHAI

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 628 wrote to memory of 2412	628	rundll32.exe	WerFault.exe
PID 628 wrote to memory of 2412	628	rundll32.exe	WerFault.exe
PID 628 wrote to memory of 2412	628	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kg_patch\windows\ida32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 628 -s 120
2⤵
PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads