e13f7019f8f66e379c29b0854bf93bd7f3f33fa02e890879094c1ee5213b7760 | Triage

Analysis

max time kernel
135s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2023 06:50

Sharing

Report Analysis Logs

General

Target

erbium.dll
Size

2.7MB
MD5

78458186578e35ac9b8539053d144d47
SHA1

4110152901a842e4e53f10647b91fe8d77c169c7
SHA256

e13f7019f8f66e379c29b0854bf93bd7f3f33fa02e890879094c1ee5213b7760
SHA512

cb16a166653d26b7294b8d5c67962b014dab9c0e89a7a9fe3605095e8de47296778f31f00cba6608cf7a8436b43661246049ee80a086bb9fe593df710e3d5548
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcC2ek:P1Kqvv07noI7lOOYcG

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1532	2848	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 2848	4500	rundll32.exe	84
PID 4500 wrote to memory of 2848	4500	rundll32.exe	84
PID 4500 wrote to memory of 2848	4500	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\erbium.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\erbium.dll,#1
  2⤵
  PID:2848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 560
    3⤵
    - Program crash
    PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2848 -ip 2848
1⤵
PID:3320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads