2a6ecde72991f3e1dba3d49106e26237bd95a505cd97d0b5caea59723e6fb28e | Triage

Resubmissions

21-02-2023 11:28

230221-nk4hrsge2v 10

18-02-2023 02:18

230218-cq92ysaa6x 8

Analysis

max time kernel
24s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-02-2023 11:28

Sharing

Report Analysis Logs

General

Target

x86/AIDE.dll
Size

2.0MB
MD5

ad388ce4c2cc3aaff605994da782d57e
SHA1

f43c3f588c77a34e8b81b63247ac1d7657016050
SHA256

d3ba1adbfeef8f19e4aa570299c06d39a87dfc5fe3d85946270b722e44dacda7
SHA512

f8e8f0fc5d8e01f8afe1aac55d3a301fa0019c6e80099616abf5a41c09aeabd0294e4391ddac170c2cd5bcff0b9e9cb4b559a2eca50a273e398083542065e27b
SSDEEP

49152:h50rEANbHm4w0H5QZXjr/nZA9XANcZ4T5lQ:b0rEcbG4w0H5QZTrnZEmlu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2028 2020 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2024 wrote to memory of 2020	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2020	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2020	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2020	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2020	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2020	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 2020	2024	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2028	2020	rundll32.exe	WerFault.exe
PID 2020 wrote to memory of 2028	2020	rundll32.exe	WerFault.exe
PID 2020 wrote to memory of 2028	2020	rundll32.exe	WerFault.exe
PID 2020 wrote to memory of 2028	2020	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\AIDE.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\x86\AIDE.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 224
3⤵
- Program crash
PID:2028

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...