Resubmissions

11-04-2022 12:46

220411-pzzc2aabg7 10

11-04-2022 08:06

220411-jzv3qafca6 3

11-04-2022 08:02

220411-jxdewsfbe7 1

10-04-2022 10:22

220410-mekm2acge9 3

10-04-2022 10:21

220410-mdtjjshebm 1

10-04-2022 09:11

220410-k5l8facah7 3

10-04-2022 09:05

220410-k19syacae5 1

10-04-2022 08:57

220410-kwky1sbhh3 3

Analysis

  • max time kernel
    962s
  • max time network
    1231s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    11-04-2022 08:06

General

  • Target

    MFMediaEngine.dll

  • Size

    990KB

  • MD5

    e0ecf5e7d2a4656457fabeee2918ef38

  • SHA1

    ca05587d9bd333a62735705ba6b3f919ea7d6d17

  • SHA256

    4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2

  • SHA512

    f2dc88e57feab0dcc8ad36dd313413d4735350343573f6c8721b5cae48a8ceff393dfd9bcf327d9eb4114347ad704de6dbcfffc42aa53876ba0b017011ac9ddc

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\MFMediaEngine.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\MFMediaEngine.dll
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 1260
        3⤵
        • Program crash
        PID:4252
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3048 -ip 3048
    1⤵
      PID:2620

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3048-124-0x0000000000000000-mapping.dmp