2d17385ee0b70a6b61192b70ed2edc6d67907cd883a8fdb565fad1f357fb7140 | Triage

Analysis

max time kernel
4294622s
max time network
621s
platform
windows7_x64
resource
win7-20220310-en
submitted
16-03-2022 16:53

Sharing

Report Analysis Logs

General

Target

Bloom/nw.dll
Size

135.1MB
MD5

489e0f5918e03f05484164fbf7bcb6b2
SHA1

c194749cc94f94ff57b7f8f8d036d52da23e67f1
SHA256

3706d03962609d3c64bcd7859a81dbe5b8f337020705bebe97d502e7a96b7455
SHA512

ae007e8822c56a7260adf39261340c1b33854c50a2c10d6aa4d52e4035451330be408b42c1f2c3497fcae95ee3eeeccd538214da5d28a68a5e878ae7458205c6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1140	1916	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1140	1916	rundll32.exe	27
PID 1916 wrote to memory of 1140	1916	rundll32.exe	27
PID 1916 wrote to memory of 1140	1916	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bloom\nw.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1916 -s 204
  2⤵
  - Program crash
  PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads