e13f7019f8f66e379c29b0854bf93bd7f3f33fa02e890879094c1ee5213b7760 | Triage

Analysis

max time kernel
26s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-04-2023 06:50

Sharing

Report Analysis Logs

General

Target

erbium.dll
Size

2.7MB
MD5

78458186578e35ac9b8539053d144d47
SHA1

4110152901a842e4e53f10647b91fe8d77c169c7
SHA256

e13f7019f8f66e379c29b0854bf93bd7f3f33fa02e890879094c1ee5213b7760
SHA512

cb16a166653d26b7294b8d5c67962b014dab9c0e89a7a9fe3605095e8de47296778f31f00cba6608cf7a8436b43661246049ee80a086bb9fe593df710e3d5548
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcC2ek:P1Kqvv07noI7lOOYcG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
332	932	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 896 wrote to memory of 932	896	rundll32.exe	28
PID 896 wrote to memory of 932	896	rundll32.exe	28
PID 896 wrote to memory of 932	896	rundll32.exe	28
PID 896 wrote to memory of 932	896	rundll32.exe	28
PID 896 wrote to memory of 932	896	rundll32.exe	28
PID 896 wrote to memory of 932	896	rundll32.exe	28
PID 896 wrote to memory of 932	896	rundll32.exe	28
PID 932 wrote to memory of 332	932	rundll32.exe	29
PID 932 wrote to memory of 332	932	rundll32.exe	29
PID 932 wrote to memory of 332	932	rundll32.exe	29
PID 932 wrote to memory of 332	932	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\erbium.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\erbium.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 196
    3⤵
    - Program crash
    PID:332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads