95a8e22f4586b962c8bbe268f28b9561ecfafc06bee75f3571ced253d66d5531 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 16:58

Sharing

Report Analysis Logs

General

Target

icuuc30.dll
Size

660KB
MD5

44f425267038283db1822910679aa32d
SHA1

5028fdd93a8e3ea761149ac0d766af207ebedc9d
SHA256

a128b8d73f4bc08f0b017789f57a0c20238ff0294361d5ce0233ca75f9eb691a
SHA512

918125b249945547d5c263876680867018b9442cd147670c144d6227fe01d1304d5a5305b9d57d24db1eaa4e19dae1a72b0f9f7e32a7bcd4c38b097143b2bd36
SSDEEP

12288:rGS0YPmKEK9uxS4TCNfbg4ibCcoInBliDxVPLkQGSWDhap:FmKEKEsnJbg4iFoIBliPLkvph

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3208 4328 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4140 wrote to memory of 4328	4140	rundll32.exe	rundll32.exe
PID 4140 wrote to memory of 4328	4140	rundll32.exe	rundll32.exe
PID 4140 wrote to memory of 4328	4140	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuuc30.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuuc30.dll,#1
2⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 616
3⤵
- Program crash
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4328 -ip 4328
1⤵
PID:4416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...