49febd721b50c554167b59bc876a1a261896822096e39357e67cf9ef9dbaaae4 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13-06-2024 07:02

Sharing

Report Analysis Logs

General

Target

udis.dll
Size

129KB
MD5

88e01cf86d15be0df1209c5f0f76e4f5
SHA1

6f0a0e19acdf66764c5fd0a03c1787a982746c6c
SHA256

4f21456111057cfae3147c674573a3f72edc2ab22d1ea2b1b07611bfe9678eca
SHA512

6c1a3a9255b681a877ccc1fb088bce77437c40cfd5e4592064dd7b9a8554630b2beb6affcd2f9681889e013d27c9219f10139fe86e5678968236baa4482ff4c6
SSDEEP

1536:3oytRJNwZ2wcUH8jeo46JH5ujVrWpPwMmOZoqqPu23ipyqb1EE4:YyM6UcjznCWKOZo/Pu2iN1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

468 4268 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1960 wrote to memory of 4268	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 4268	1960	rundll32.exe	rundll32.exe
PID 1960 wrote to memory of 4268	1960	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\udis.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\udis.dll,#1
2⤵
PID:4268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 600
3⤵
- Program crash
PID:468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4268 -ip 4268
1⤵
PID:4776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...