d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 18:55

Sharing

Report Analysis Logs

General

Target

udis.dll
Size

129KB
MD5

88e01cf86d15be0df1209c5f0f76e4f5
SHA1

6f0a0e19acdf66764c5fd0a03c1787a982746c6c
SHA256

4f21456111057cfae3147c674573a3f72edc2ab22d1ea2b1b07611bfe9678eca
SHA512

6c1a3a9255b681a877ccc1fb088bce77437c40cfd5e4592064dd7b9a8554630b2beb6affcd2f9681889e013d27c9219f10139fe86e5678968236baa4482ff4c6
SSDEEP

1536:3oytRJNwZ2wcUH8jeo46JH5ujVrWpPwMmOZoqqPu23ipyqb1EE4:YyM6UcjznCWKOZo/Pu2iN1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1676 1664 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2340 wrote to memory of 1664	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1664	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1664	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1664	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1664	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1664	2340	rundll32.exe	rundll32.exe
PID 2340 wrote to memory of 1664	2340	rundll32.exe	rundll32.exe
PID 1664 wrote to memory of 1676	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 1676	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 1676	1664	rundll32.exe	WerFault.exe
PID 1664 wrote to memory of 1676	1664	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\udis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\udis.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 220
3⤵
- Program crash
PID:1676

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...