736749551049aeab7013609e8a24a3dfb999f5619d395e4e021d566d11702b03 | Triage

Resubmissions

23-04-2022 17:17

220423-vt64kshfdj 10

21-04-2022 15:50

220421-s9w77sbcdr 10

Analysis

max time kernel
136s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-04-2022 15:50

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Java.Ratty.2.15503.dll
Size

740KB
MD5

c361d2beccf54f9c0399a5dc1366c889
SHA1

1744e717854b7308abf1064c98c3da1bc5084035
SHA256

736749551049aeab7013609e8a24a3dfb999f5619d395e4e021d566d11702b03
SHA512

c148e7062a6a94161b266c709b907c8d16b2d9aa019291db17c28dd054eaf3a5fee07f81cb98f3bd61f7dca33d308ea8845f06016ccc07f0725c115542919376

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3156 564 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2216 wrote to memory of 564	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 564	2216	rundll32.exe	rundll32.exe
PID 2216 wrote to memory of 564	2216	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Java.Ratty.2.15503.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Java.Ratty.2.15503.dll,#1
  2⤵
  PID:564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 564
    3⤵
    - Program crash
    PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 564 -ip 564
1⤵
PID:2576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-130-0x0000000000000000-mapping.dmp

Download