1c95e2de3bca3fea01374b156e547a840d0adf592d7ef17155c54fcbc6d69841 | Triage

Analysis

max time kernel
93s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 09:09

Sharing

Report Analysis Logs

General

Target

SFhelper.dll
Size

60KB
MD5

a2f3195a34dfb07900fc784a32a37d3f
SHA1

7e60c4ec6e1aece0de663f5ca614d22a77cc680b
SHA256

c0234f29167c2d0b6284dd3a32a0a6c1ab9bbd2f2475ccf5c3e758d4070835ea
SHA512

3aaaebdad04878af5a9692308b1ee7f91dd6682f9b046a23e803001bb6df5b87550a06c1c3b4be93169a582935859e3af0fce2947e01d56ead3bb204a9458c55
SSDEEP

1536:6QkiaCePX+reI3QkQpWhuVXSigCWgOQgrfqC:6QkiDePiP3mpWwVXSigKONL

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2140 4072 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2772 wrote to memory of 4072	2772	rundll32.exe	rundll32.exe
PID 2772 wrote to memory of 4072	2772	rundll32.exe	rundll32.exe
PID 2772 wrote to memory of 4072	2772	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SFhelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SFhelper.dll,#1
2⤵
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 592
3⤵
- Program crash
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4072 -ip 4072
1⤵
PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...