40702b0d2a57d292c5bdfbf1ab1db3da71dacc942dc6838b10458f185800d6e5 | Triage

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 14:43

Sharing

Report Analysis Logs

General

Target

MultiBit/_decimal.dll
Size

226KB
MD5

327bb8ad9e4e30c079c184b960e747f8
SHA1

573c60f972ffd0f32fec005333023d7c58b44867
SHA256

382ad65be697bccce12b0826c2601ba05e45d936651ba834b545b3d7261d2a87
SHA512

920023b01eecbdc3c0f8572121033be72224779df59bc3259e48f849c94737c907facdd1d3e397ab948969a368d15104b08a6af6121578618462b55399ac71c5
SSDEEP

6144:g+CdBO+WLvRxuFcQAHe0nDx3tUftGuq6xx3XMW5gxrSax:g/7O/LRxuFcQYlDx3taLaSax

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3672 4800 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2324 wrote to memory of 4800	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 4800	2324	rundll32.exe	rundll32.exe
PID 2324 wrote to memory of 4800	2324	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\_decimal.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MultiBit\_decimal.dll,#1
2⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 628
3⤵
- Program crash
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4800 -ip 4800
1⤵
PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...