e498b7a3b8c47519121d0f94bca46d9d4f4611a348377a1070cad78745e4f1b2 | Triage

Analysis

max time kernel
8s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2022 07:52

Sharing

Report Analysis Logs

General

Target

resources/updaterinventory.dll
Size

390KB
MD5

67833490c932595c1d43e4ff6af8032a
SHA1

63b51d67b5bf352612b4e6becf8baea6f6f63bf8
SHA256

25df5b89e67dff662889f4cb971ed187a5edd79cb17078034b194f7102d28a85
SHA512

2a99d2cd919a4623e6a37bfd1fe409986fc5f048abe5176037657ba58d536c14fddb80f411faf145e4defcaf48f828f346faff059dd0962e8dce0fcd674619ff
SSDEEP

12288:HEWx47pu9X6K0PtT0HOfwqevSvdvmvmNb1NPFb:kWUpu9KJtT0HOfwGNb1Tb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

792 4900 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4824 wrote to memory of 4900	4824	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 4900	4824	rundll32.exe	rundll32.exe
PID 4824 wrote to memory of 4900	4824	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\updaterinventory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\resources\updaterinventory.dll,#1
2⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 624
3⤵
- Program crash
PID:792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4900 -ip 4900
1⤵
PID:4800

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4900-132-0x0000000000000000-mapping.dmp

Download