2fb300fa54859ae9d0e55a6db8908d18da513c93d6e34f01d092a6a436e448c6 | Triage

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 18:19

Sharing

Report Analysis Logs

General

Target

buyer/mobbed.dll
Size

596KB
MD5

54edac83f5458ce5be9a1f3f02f422e5
SHA1

db4667d4430e6082eb371b3be50e3cce09d762b7
SHA256

6b5f03f1e1ecbf54ddacf8527f332d76ab57d0f65088b0129d408e944272c806
SHA512

2701745b7f60dcf0dda9f7dd862fb19e8a86f4f2a1e74c7e381483714bb08ff620a4c74d4f3065c1dc4f997e038a16223e4bda4e6c36876dd29a131a5a313334
SSDEEP

12288:4n8S739YoRmwZBY9bk8OlBf07A4QDXSAIdQFFF7:48+FR7tVlDXScn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1560 1196 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1196	1328	rundll32.exe	rundll32.exe
PID 1196 wrote to memory of 1560	1196	rundll32.exe	WerFault.exe
PID 1196 wrote to memory of 1560	1196	rundll32.exe	WerFault.exe
PID 1196 wrote to memory of 1560	1196	rundll32.exe	WerFault.exe
PID 1196 wrote to memory of 1560	1196	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\buyer\mobbed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\buyer\mobbed.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 224
3⤵
- Program crash
PID:1560

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-54-0x0000000000000000-mapping.dmp

Download
memory/1196-55-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1560-56-0x0000000000000000-mapping.dmp

Download