43a1c18af9fd05064e90c71f096262524ca181aa98df211c2365396067e9994b | Triage

Resubmissions

16-10-2022 15:45

221016-s7jjbshffn 10

19-09-2022 15:00

220919-sdbxdshgdj 10

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 15:00

Sharing

Report Analysis Logs

General

Target

uOAxPaiprCVzvn.dll
Size

3.6MB
MD5

60658cdb2f273a1a9c18ee8ff5118112
SHA1

d4665150bec840c6e8be62c2c6cdebc42ef5ea19
SHA256

ded7c0c21ca7f16e70ed2b1a774bab54019d6b3fb865677eba254edeafd7b91e
SHA512

05989c1aefce87569dfe31de09507ec965123e8b776db237c8c974cebe8c5c275858ccfbcec3124e5fc0450442afac0d2a08cee3919ac9bc68e19c06128c46e6
SSDEEP

24576:Q4kkbEgHWUYr/Ql/V6+Zr0dyFMftqscMOdIYro8u6c4KCtrw9:QhkbEg29sl6O

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2044	1896	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27
PID 1896 wrote to memory of 2044	1896	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\uOAxPaiprCVzvn.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1896 -s 84
  2⤵
  - Program crash
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads