2fb300fa54859ae9d0e55a6db8908d18da513c93d6e34f01d092a6a436e448c6 | Triage

Analysis

max time kernel
185s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2022 18:19

Sharing

Report Analysis Logs

General

Target

buyer/mobbed.dll
Size

596KB
MD5

54edac83f5458ce5be9a1f3f02f422e5
SHA1

db4667d4430e6082eb371b3be50e3cce09d762b7
SHA256

6b5f03f1e1ecbf54ddacf8527f332d76ab57d0f65088b0129d408e944272c806
SHA512

2701745b7f60dcf0dda9f7dd862fb19e8a86f4f2a1e74c7e381483714bb08ff620a4c74d4f3065c1dc4f997e038a16223e4bda4e6c36876dd29a131a5a313334
SSDEEP

12288:4n8S739YoRmwZBY9bk8OlBf07A4QDXSAIdQFFF7:48+FR7tVlDXScn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2708 5092 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4300 wrote to memory of 5092	4300	rundll32.exe	rundll32.exe
PID 4300 wrote to memory of 5092	4300	rundll32.exe	rundll32.exe
PID 4300 wrote to memory of 5092	4300	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\buyer\mobbed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4300

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\buyer\mobbed.dll,#1
2⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 600
3⤵
- Program crash
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 5092 -ip 5092
1⤵
PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5092-133-0x0000000000000000-mapping.dmp

Download