d1d65a8a10ee7258e2c0c2d43a8180a0faa56c399c76eecd075d053d565a8ddd | Triage

Analysis

max time kernel
136s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 18:55

Sharing

Report Analysis Logs

General

Target

udis.dll
Size

129KB
MD5

88e01cf86d15be0df1209c5f0f76e4f5
SHA1

6f0a0e19acdf66764c5fd0a03c1787a982746c6c
SHA256

4f21456111057cfae3147c674573a3f72edc2ab22d1ea2b1b07611bfe9678eca
SHA512

6c1a3a9255b681a877ccc1fb088bce77437c40cfd5e4592064dd7b9a8554630b2beb6affcd2f9681889e013d27c9219f10139fe86e5678968236baa4482ff4c6
SSDEEP

1536:3oytRJNwZ2wcUH8jeo46JH5ujVrWpPwMmOZoqqPu23ipyqb1EE4:YyM6UcjznCWKOZo/Pu2iN1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2172 1844 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 372 wrote to memory of 1844	372	rundll32.exe	rundll32.exe
PID 372 wrote to memory of 1844	372	rundll32.exe	rundll32.exe
PID 372 wrote to memory of 1844	372	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\udis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\udis.dll,#1
2⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 600
3⤵
- Program crash
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1844 -ip 1844
1⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3212,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
1⤵
PID:3604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...