1c388a8bd8a2f14fb270c3bcd6ef475f7536f1dd6412f0e91746c054d15db58d | Triage

Analysis

max time kernel
148s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 21:55

Sharing

Report Analysis Logs

General

Target

Ծע/UUWiseHelper.dll
Size

146KB
MD5

c09c3e121ce7ef05ead3681f216a4550
SHA1

af676d70899982c4227bcc1f656e83095ea1f386
SHA256

63e9a59a04299836cec0ff7caadabbb1bc1aa50cdc66e0b71bb2aa58a1e9ccfe
SHA512

d65800f274c8fa47bf3d3d991083b3d6e37b4c5e4415bc2bc8efb29336a4066bc99dc6c10c2d26e966de37197cf5d31869e05fe5f0439a550e3d9ef39586596c
SSDEEP

3072:wQLAnZ8mWGDInSLqDZPkIusTUoEFGfQT7W5jD:3LAZ8XzS+DZPZEFGfr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2536	3524	WerFault.exe	77

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3524	1140	rundll32.exe	77
PID 1140 wrote to memory of 3524	1140	rundll32.exe	77
PID 1140 wrote to memory of 3524	1140	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\UUWiseHelper.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ծע\UUWiseHelper.dll,#1
  2⤵
  PID:3524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 672
    3⤵
    - Program crash
    PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3524 -ip 3524
1⤵
PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads