0025280674bfe3e54d490765fa720501d02e03c34bac501ca415d89b9621712d | Triage

Analysis

max time kernel
25s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-02-2023 05:26

Sharing

Report Analysis Logs

General

Target

port/cont/rich/kaps/unbcl.dll
Size

1.0MB
MD5

75beda2b1a92744dbb05878e4491dde4
SHA1

50e01b391b711c92046183a28df3eb0e92c29128
SHA256

b6e98f66ae143bc38e5381fa8c0d99e58434169f25202e520664419c2b35412b
SHA512

81359115deac81e540a1c6f95b6ee8bc57adbc7e514c5c997dcd05e20333ef3b6f52214de74bdc7b55471cfd7be5fb53dc1712cef416b7e9037d030c6c7a2b5b
SSDEEP

12288:UpiYCl2vyrqmx32Mfban+AYMTkgWOS42xGeyz:yiYC0vymu3rbGiMT5WOS42xG7

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1772 1544 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1544 wrote to memory of 1772	1544	rundll32.exe	WerFault.exe
PID 1544 wrote to memory of 1772	1544	rundll32.exe	WerFault.exe
PID 1544 wrote to memory of 1772	1544	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\port\cont\rich\kaps\unbcl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1544 -s 124
2⤵
- Program crash
PID:1772

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...