0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00 | Triage

Resubmissions

07-07-2022 11:51

220707-n1ffwafher 10

24-12-2021 14:23

211224-rp9r5aedd3 1

24-12-2021 14:21

211224-rn9ezadccp 1

23-12-2021 13:06

211223-qb3wzsafdj 3

Analysis

max time kernel
140s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07-07-2022 11:51

Sharing

Report Analysis Logs

General

Target

colorui.dll
Size

879KB
MD5

a91ba8f4a339a98fa94e810831e83d96
SHA1

871e52778597185f98eb0a57127024bcd094cf07
SHA256

0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00
SHA512

ac6fb57225f0765f40ee298e12d430d45e5d9b59f16742cb4c32f56b5663c244dad47d7c80a1919e09f4f9edc3ad0ac4645ee6aff9925c5d860651593f0b1a3e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3892	1484	WerFault.exe	80

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 312 wrote to memory of 1484	312	regsvr32.exe	80
PID 312 wrote to memory of 1484	312	regsvr32.exe	80
PID 312 wrote to memory of 1484	312	regsvr32.exe	80

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\colorui.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:312
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\colorui.dll
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 648
    3⤵
    - Program crash
    PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1484 -ip 1484
1⤵
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads