ce9113fc983ed9c41944321711d228aa57a536294b7180e407dc2f9dc17bb4ad | Triage

Analysis

max time kernel
37s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 16:11

Sharing

Report Analysis Logs

General

Target

engendering/catenary.dll
Size

596KB
MD5

740ef7c49bbf7b6dc80ada0cb1b8f824
SHA1

233dae2d621fe77935ca3d4ca1dd07b3e956914c
SHA256

5b88a129b9138aea014f1425f5b28f5937e657d778a681c0e5685481d6eefc54
SHA512

59b44da52b911e16ce00b19937739cd267931535232f317bbcfdafc24c59180ce295d156847c7bcbae2e00a16c2291f12d79ab4ac4716c41cb7465298a75b88a
SSDEEP

12288:4n8H739YoRmwZBY9bk8OlBf07A4QDXSAIdQFFF7:48bFR7tVlDXScn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

564 1976 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1628 wrote to memory of 1976	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1976	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1976	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1976	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1976	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1976	1628	rundll32.exe	rundll32.exe
PID 1628 wrote to memory of 1976	1628	rundll32.exe	rundll32.exe
PID 1976 wrote to memory of 564	1976	rundll32.exe	WerFault.exe
PID 1976 wrote to memory of 564	1976	rundll32.exe	WerFault.exe
PID 1976 wrote to memory of 564	1976	rundll32.exe	WerFault.exe
PID 1976 wrote to memory of 564	1976	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\engendering\catenary.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\engendering\catenary.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 224
3⤵
- Program crash
PID:564

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-56-0x0000000000000000-mapping.dmp

Download
memory/1976-54-0x0000000000000000-mapping.dmp

Download
memory/1976-55-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download