736749551049aeab7013609e8a24a3dfb999f5619d395e4e021d566d11702b03 | Triage

Resubmissions

23-04-2022 17:17

220423-vt64kshfdj 10

21-04-2022 15:50

220421-s9w77sbcdr 10

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
23-04-2022 17:17

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Java.Ratty.2.15503.dll
Size

740KB
MD5

c361d2beccf54f9c0399a5dc1366c889
SHA1

1744e717854b7308abf1064c98c3da1bc5084035
SHA256

736749551049aeab7013609e8a24a3dfb999f5619d395e4e021d566d11702b03
SHA512

c148e7062a6a94161b266c709b907c8d16b2d9aa019291db17c28dd054eaf3a5fee07f81cb98f3bd61f7dca33d308ea8845f06016ccc07f0725c115542919376

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2984 1672 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

rundll32.execmd.exe

description	pid	process	target process
PID 1604 wrote to memory of 1672	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1672	1604	rundll32.exe	rundll32.exe
PID 1604 wrote to memory of 1672	1604	rundll32.exe	rundll32.exe
PID 4952 wrote to memory of 2904	4952	cmd.exe	rundll32.exe
PID 4952 wrote to memory of 2904	4952	cmd.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Java.Ratty.2.15503.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Java.Ratty.2.15503.dll,#1
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 560
    3⤵
    - Program crash
    PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1672 -ip 1672
1⤵
PID:4068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4356

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\system32\rundll32.exe
  rundll32 SecuriteInfo.com.Java.Ratty.2.15503.dll
  2⤵
  PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-130-0x0000000000000000-mapping.dmp

Download
memory/2904-131-0x0000000000000000-mapping.dmp

Download