eee4cedb41e61dbfd4c6b7838b57661a2fffdda006a1bc957d23d703ec316901 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 13:40

Sharing

Report Analysis Logs

General

Target

spoofer/crack.dll
Size

2.3MB
MD5

a99ecd8ec643dc9db372736fd6fd8eb5
SHA1

91e8270faf4666ca60d9b41ece1dd3f25c0fd8fd
SHA256

6fa983aab41fbe45a79236330245c49fbb318b75efb4bc6b78fa551d29ace518
SHA512

a8cd99023e6db3352a96ac7179acc5ae9e09e186f1a9ff55672fdac520821ef51cc48a7ac821b862966959ab174b49f17057744491656b9832b6dda61fd157bd
SSDEEP

49152:IK+yy5eom+KbDbF7BBLz1iYCY6nWefdmjLdGGf:Zom+Kbtz1iYCY6HfdmjLdGGf

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 1972 wrote to memory of 1908	1972	rundll32.exe	30
PID 1972 wrote to memory of 1908	1972	rundll32.exe	30
PID 1972 wrote to memory of 1908	1972	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\spoofer\crack.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1972 -s 88
  2⤵
  PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-0-0x0000000063340000-0x000000006342C000-memory.dmp

Filesize
944KB

Download