e498b7a3b8c47519121d0f94bca46d9d4f4611a348377a1070cad78745e4f1b2 | Triage

Analysis

max time kernel
0s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-10-2022 07:52

Sharing

Report Analysis Logs

General

Target

resources/updaterinventory.dll
Size

390KB
MD5

67833490c932595c1d43e4ff6af8032a
SHA1

63b51d67b5bf352612b4e6becf8baea6f6f63bf8
SHA256

25df5b89e67dff662889f4cb971ed187a5edd79cb17078034b194f7102d28a85
SHA512

2a99d2cd919a4623e6a37bfd1fe409986fc5f048abe5176037657ba58d536c14fddb80f411faf145e4defcaf48f828f346faff059dd0962e8dce0fcd674619ff
SSDEEP

12288:HEWx47pu9X6K0PtT0HOfwqevSvdvmvmNb1NPFb:kWUpu9KJtT0HOfwGNb1Tb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1168 2028 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1064 wrote to memory of 2028	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2028	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2028	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2028	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2028	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2028	1064	rundll32.exe	rundll32.exe
PID 1064 wrote to memory of 2028	1064	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 1168	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1168	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1168	2028	rundll32.exe	WerFault.exe
PID 2028 wrote to memory of 1168	2028	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\updaterinventory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\updaterinventory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 224
3⤵
- Program crash
PID:1168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-56-0x0000000000000000-mapping.dmp

Download
memory/2028-54-0x0000000000000000-mapping.dmp

Download
memory/2028-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download