8286913b27550033c014364f88fd7b80a506f3a0da12e08224369b798582cbd2 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-11-2024 15:22

Sharing

Report Analysis Logs

General

Target

ProtobufLite.dll
Size

530KB
MD5

a9ad3484442b9ddae6d44d990928d7d7
SHA1

dfd46b53cce5f8b57f4755dfa2b97822c5756c71
SHA256

9b751393d74c2b21e80bfa205dc30021d93dfd483168c67f81e2619a79f6a012
SHA512

8d17e8f2f6c85ec84c8763f20c1e5ca3c00b5a1c6ea5167ae840d2056ca205f1029c5d89885e0c43bfa175d0a98b17fac2989960b65f13dd7a434a395f41c2b5
SSDEEP

6144:kyUOGY5EhEDjrK5wFEIaY3mFFxpxxp3ICm/py8L:on8nowFEwT

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 328 wrote to memory of 2516	328	rundll32.exe	WerFault.exe
PID 328 wrote to memory of 2516	328	rundll32.exe	WerFault.exe
PID 328 wrote to memory of 2516	328	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ProtobufLite.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:328
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 328 -s 112
  2⤵
  PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads