59e4fac681f8e2e2db47821e1d1e1d76713363dadd006ee060d396b363c43e27 | Triage

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 14:08

Sharing

Report Analysis Logs

General

Target

windows/libdwarf.dll
Size

276KB
MD5

c52f1c57c12424bf36b9a5922653d92f
SHA1

90b6ff23cf50ea271d0e26deb8f32fae0684d00d
SHA256

50df0a2c54670fc0a803035cb4a2b25d422e58cc725ff7aecc4683459df7a696
SHA512

0c7295301d8c155afd23a3d137c62664ceb75e10bb4e2952784f22b02f7cdc79150d8201566d4995b0b4c3eb341a9ff321285011cef703d52877acbac0493013
SSDEEP

6144:zPIo8cfbsfeMQ9y+t/qcGMbg2QrYCkS+Nhnxk:Eo8c5MEF8nYCE

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2084	2544	rundll32.exe	30
PID 2544 wrote to memory of 2084	2544	rundll32.exe	30
PID 2544 wrote to memory of 2084	2544	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\windows\libdwarf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2544 -s 80
  2⤵
  PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads