0058b4f69b0e6b9fc2eaca10a9bfb41e72e6cd72a827f8740fefde876194bade | Triage

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08/09/2022, 02:29

Sharing

Report Analysis Logs

General

Target

PowerISO/App/PowerISO64/MACDll.dll
Size

162KB
MD5

ebc96e6a55cb41994f8c6cfc6b012ab5
SHA1

c4ac1f5bbb523d9d9a69d9f66b66ea8e73eda413
SHA256

d8434c7cf6eb19ae8efd63615f46a858dc4db681beb25e30ce4c5653d1405862
SHA512

d0c7298f0d51400db45b626d2a089ae7f7c6636ff28399b7ace2e6033ef6165993e41de1c93963ac3bbf4120f614c2fd99856b97c6f15022773dca8932a75a2e
SSDEEP

3072:nbI6YoDnmvrwuGhxAMOAKz/VsXowHswtLLxu:nZYoDnAG7CpDS4wMU

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1880	1488	WerFault.exe	19

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1880	1488	rundll32.exe	28
PID 1488 wrote to memory of 1880	1488	rundll32.exe	28
PID 1488 wrote to memory of 1880	1488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PowerISO\App\PowerISO64\MACDll.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1488 -s 84
  2⤵
  - Program crash
  PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads