2d17385ee0b70a6b61192b70ed2edc6d67907cd883a8fdb565fad1f357fb7140 | Triage

Analysis

max time kernel
135s
max time network
699s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
16-03-2022 16:53

Sharing

Report Analysis Logs

General

Target

Bloom/nw.dll
Size

135.1MB
MD5

489e0f5918e03f05484164fbf7bcb6b2
SHA1

c194749cc94f94ff57b7f8f8d036d52da23e67f1
SHA256

3706d03962609d3c64bcd7859a81dbe5b8f337020705bebe97d502e7a96b7455
SHA512

ae007e8822c56a7260adf39261340c1b33854c50a2c10d6aa4d52e4035451330be408b42c1f2c3497fcae95ee3eeeccd538214da5d28a68a5e878ae7458205c6

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
680	4152	WerFault.exe	15
2468	4152	WerFault.exe	15

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 680	4152	rundll32.exe	82
PID 4152 wrote to memory of 680	4152	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Bloom\nw.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4152 -s 464
  2⤵
  - Program crash
  PID:680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4152 -s 464
  2⤵
  - Program crash
  PID:2468

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 360 -p 4152 -ip 4152
1⤵
PID:4860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads