015d7e09fabb3c9bf28ca4887830dcdecee775c490229b34c445ad06bf24ff6b | Triage

Analysis

max time kernel
10s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 03:54

Sharing

Report Analysis Logs

General

Target

port/cont/rich/kaps/unbcl.dll
Size

1.0MB
MD5

75beda2b1a92744dbb05878e4491dde4
SHA1

50e01b391b711c92046183a28df3eb0e92c29128
SHA256

b6e98f66ae143bc38e5381fa8c0d99e58434169f25202e520664419c2b35412b
SHA512

81359115deac81e540a1c6f95b6ee8bc57adbc7e514c5c997dcd05e20333ef3b6f52214de74bdc7b55471cfd7be5fb53dc1712cef416b7e9037d030c6c7a2b5b
SSDEEP

12288:UpiYCl2vyrqmx32Mfban+AYMTkgWOS42xGeyz:yiYC0vymu3rbGiMT5WOS42xG7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1964 1692 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1692 wrote to memory of 1964	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1964	1692	rundll32.exe	WerFault.exe
PID 1692 wrote to memory of 1964	1692	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\port\cont\rich\kaps\unbcl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1692 -s 124
  2⤵
  - Program crash
  PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads