9b570603035afe928824e50b04cd7f2ef91240dbd7a03bf056e202b9e7193896 | Triage

Analysis

max time kernel
144s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 18:37

Sharing

Report Analysis Logs

General

Target

ApiClient.dll
Size

236KB
MD5

857b1f7cfd086a2fd24b978712eb8380
SHA1

bb73a0c41e9064e424c2b5b8cd84c368d1cc9179
SHA256

55ce30aa67d0aa7068d01036c4d267eea9ef36315c674fca4458aa0b3d2bd67e
SHA512

5e43dea1414e72e35886b1a9b190072cbb2879987d5c37eb7ca3b4bf5a54229d78c933b3d478e6ebf065c34096a8adbed95b16e91755e069e2cfe3c9c5dedc6d
SSDEEP

6144:oWpFcAT3+H+vWvSn6wmSFAIQBBohcc56XW:riAT3+HnS642BBoqfXW

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1008 4348 WerFault.exe rundll32.exe
4288 4348 WerFault.exe rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ApiClient.dll,#1
1⤵
PID:4348

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4348 -s 328
2⤵
- Program crash
PID:1008

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4348 -s 328
2⤵
- Program crash
PID:4288

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 4348 -ip 4348
1⤵
PID:2932

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 4348 -ip 4348
1⤵
PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...