40702b0d2a57d292c5bdfbf1ab1db3da71dacc942dc6838b10458f185800d6e5 | Triage

Analysis

max time kernel
86s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2023 20:34

Sharing

Report Analysis Logs

General

Target

MultiBit/_asyncio.dll
Size

59KB
MD5

f5d81b2fb250ad4bdac8fb29b9bb4885
SHA1

e8893fed89d122c597a595efa53b710934873f46
SHA256

f367c877c2c547b8f65d00e0c1d8c6f9b448ad30eef047deac28e35f5b8dd24a
SHA512

dbbda8f37541198bc477294a1ba630f6f6ec772c77b26944b55588ae63d1770940d06de3ccffd6065bec43c685e37986071b7c741049031962188ae1d992d7d2
SSDEEP

1536:dw7HUgU+wU9IYrya9M4fvzBa5GUBaWRztIW5nbR7SyXMTJ:dwL7lw4DBfbI5GUBaWRztIW5nbRSTJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3696 4764 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 312 wrote to memory of 4764	312	rundll32.exe	rundll32.exe
PID 312 wrote to memory of 4764	312	rundll32.exe	rundll32.exe
PID 312 wrote to memory of 4764	312	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\_asyncio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:312

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\_asyncio.dll,#1
2⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 628
3⤵
- Program crash
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4764 -ip 4764
1⤵
PID:4772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...