40702b0d2a57d292c5bdfbf1ab1db3da71dacc942dc6838b10458f185800d6e5 | Triage

Analysis

max time kernel
171s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:43

Sharing

Report Analysis Logs

General

Target

MultiBit/_asyncio.dll
Size

59KB
MD5

f5d81b2fb250ad4bdac8fb29b9bb4885
SHA1

e8893fed89d122c597a595efa53b710934873f46
SHA256

f367c877c2c547b8f65d00e0c1d8c6f9b448ad30eef047deac28e35f5b8dd24a
SHA512

dbbda8f37541198bc477294a1ba630f6f6ec772c77b26944b55588ae63d1770940d06de3ccffd6065bec43c685e37986071b7c741049031962188ae1d992d7d2
SSDEEP

1536:dw7HUgU+wU9IYrya9M4fvzBa5GUBaWRztIW5nbR7SyXMTJ:dwL7lw4DBfbI5GUBaWRztIW5nbRSTJ

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5088 4164 WerFault.exe rundll32.exe
2688 4164 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4592 wrote to memory of 4164	4592	rundll32.exe	rundll32.exe
PID 4592 wrote to memory of 4164	4592	rundll32.exe	rundll32.exe
PID 4592 wrote to memory of 4164	4592	rundll32.exe	rundll32.exe
PID 4164 wrote to memory of 5088	4164	rundll32.exe	WerFault.exe
PID 4164 wrote to memory of 5088	4164	rundll32.exe	WerFault.exe
PID 4164 wrote to memory of 5088	4164	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\_asyncio.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\_asyncio.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 628
3⤵
- Program crash
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 628
3⤵
- Program crash
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4164 -ip 4164
1⤵
PID:996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...