Analysis

  • max time kernel
    154s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05-03-2023 22:49

General

  • Target

    publish/bin/libatk-1.0-0.dll

  • Size

    136KB

  • MD5

    ce9ab2defa6d7a584152a54108c30bfc

  • SHA1

    8b221ad2c5c428c0b73b30f9fbebd1a99186c8f1

  • SHA256

    2a80279b8dbeec1bb9b4121ccd4801034599184dab1c9166d5a29df1fd819df9

  • SHA512

    10a9d8e4ad9d120260273f70c2a820c10429cff86ba770ffe1cb0f57097175e1367c52b7f7a97ac29e62b09f08a2799f3c43faf9df25dd44d39fed44b25ecd89

  • SSDEEP

    1536:lQ/IMw1Tk3vQeJEMq8iMjIV9WBmF/9yjr7YrDn8KBBIxpRu63GQsU9jDQn7BmCoU:6ETWvrEMq8iMjIfKjArDnP0EzUxDGMvU

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libatk-1.0-0.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:892
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 892 -s 184
      2⤵
      • Program crash
      PID:1564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/892-54-0x000000006BD40000-0x000000006BD69000-memory.dmp
    Filesize

    164KB

  • memory/892-55-0x00000000649C0000-0x0000000064AE5000-memory.dmp
    Filesize

    1.1MB

  • memory/892-57-0x0000000066000000-0x000000006610B000-memory.dmp
    Filesize

    1.0MB

  • memory/892-56-0x0000000061CC0000-0x0000000061CE8000-memory.dmp
    Filesize

    160KB

  • memory/892-58-0x0000000064940000-0x0000000064955000-memory.dmp
    Filesize

    84KB

  • memory/892-59-0x0000000069140000-0x000000006918E000-memory.dmp
    Filesize

    312KB

  • memory/892-60-0x0000000067F00000-0x0000000067F57000-memory.dmp
    Filesize

    348KB

  • memory/892-61-0x000000006B740000-0x000000006B750000-memory.dmp
    Filesize

    64KB