a00efafb9deb99a99bfdd34f55818983e9cc675d1cac6b71b9fec4b0bea1aa56

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 08:22

Target

CoralTrident.dll
Size

506KB
MD5

993b059afd143fcd153d4aa1e456a5bb
SHA1

8a7bdd26b963b65cd490f25c21340f5f10dccb1d
SHA256

aecae09d1637cd5910b06fa41ee73fb2cdde6c8756a535152c6fec9cb4b9253b
SHA512

dc5dc8ca1f4ee7a88ad43b790d1563ff27c335df6931eaa0041cf78c4602a56792c93c6a1cfa71b42693c91dd76366186b27b3f63c7f05a3440fb97f47761d0d
SSDEEP

6144:3lkKz9RPBkGKRHTNbxuecoTlj7DifMw9OrJhNVtUV3SY+2ad1TXc+fcOgCiSC:nBWTNnhcfMagraJrOTX33C

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4388 920 WerFault.exe rundll32.exe

pid	pid_target	process	target process
4388	920	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3300 wrote to memory of 920	3300	rundll32.exe	rundll32.exe
PID 3300 wrote to memory of 920	3300	rundll32.exe	rundll32.exe
PID 3300 wrote to memory of 920	3300	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralTrident.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\CoralTrident.dll,#1
2⤵
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 732
3⤵
- Program crash
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 920 -ip 920
1⤵
PID:4804