173b14b1b579add43d7434822a7513d175167c22a1cc50d8e84c63bcb9e5d572 | Triage

Analysis

max time kernel
380s
max time network
617s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
17-01-2023 18:49

Sharing

Report Analysis Logs

General

Target

b.dll
Size

60KB
MD5

5359ac968f7cee07ee5b28e4f77e0a9b
SHA1

4488d17610c128cf2caf2dd27dce5767c68a10b4
SHA256

173b14b1b579add43d7434822a7513d175167c22a1cc50d8e84c63bcb9e5d572
SHA512

983db64d91d8e80899ad28b56087af8912943d2f7517db7cde9209c7d168460ba26050ce691a492e36e9a112416bce644414fa7d316594af90b3c3d1d2bb1cc3
SSDEEP

768:hO4apg9TJD/UFPvh45g1WmxValWf5uJMj9TX8Tlpd76o1x6:hHT+4mjw4OdZx

Score

3^/10

Malware Config

Signatures

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

2708 2404 WerFault.exe rundll32.exe
4252 4984 WerFault.exe regsvr32.exe
4064 5032 WerFault.exe regsvr32.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 4940 wrote to memory of 4984	4940	cmd.exe	regsvr32.exe
PID 4940 wrote to memory of 4984	4940	cmd.exe	regsvr32.exe
PID 4940 wrote to memory of 5032	4940	cmd.exe	regsvr32.exe
PID 4940 wrote to memory of 5032	4940	cmd.exe	regsvr32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b.dll,#1
1⤵
PID:2404

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2404 -s 220
2⤵
- Program crash
PID:2708

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\system32\regsvr32.exe
regsvr32 b.dll
2⤵
PID:4984

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4984 -s 380
3⤵
- Program crash
PID:4252

C:\Windows\system32\regsvr32.exe
regsvr32 /s b.dll
2⤵
PID:5032

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5032 -s 380
3⤵
- Program crash
PID:4064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4984-120-0x0000000000000000-mapping.dmp

Download
memory/5032-121-0x0000000000000000-mapping.dmp

Download