a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56 | Triage

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:22

Sharing

Report Analysis Logs

General

Target

Coral.dll
Size

583KB
MD5

afac79e92e3785299f191e74de3f366a
SHA1

d00b781bffff2967a434bc8cb69d4e6202e6f57c
SHA256

e2fd8e0e1de3035c9cddc201fea8cbdc89f91e89bfd60a1ab70bfd317e3043b8
SHA512

212f730fcd0c587ca3920c4dfbcf1266a96c87bb045f2b0ee7e80e0551c97b2978be0024ff14e3afc4e6025d273fe7508de1d7ec08d6d5ba24201a0f502f5806
SSDEEP

12288:hvixHSC0MYWG50tUvuhyGiCHnUgNGzaf3/l/2jjSj:hvixyC0MYWG50Wvu7HNGzaf3/l/wSj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2216 1416 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1972 wrote to memory of 1416	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1416	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1416	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1416	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1416	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1416	1972	rundll32.exe	rundll32.exe
PID 1972 wrote to memory of 1416	1972	rundll32.exe	rundll32.exe
PID 1416 wrote to memory of 2216	1416	rundll32.exe	WerFault.exe
PID 1416 wrote to memory of 2216	1416	rundll32.exe	WerFault.exe
PID 1416 wrote to memory of 2216	1416	rundll32.exe	WerFault.exe
PID 1416 wrote to memory of 2216	1416	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Coral.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Coral.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 252
3⤵
- Program crash
PID:2216

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...