187754f20558b7d67abb233e84ee14a85ea1791983d87d5a4dfe062799ae3d3c | Triage

Resubmissions

21/04/2023, 01:45

230421-b6dg9afd6x 10

20/04/2023, 19:19

230420-x1hexabh38 3

Analysis

max time kernel
103s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/04/2023, 01:45

Sharing

Report Analysis Logs

General

Target

3oCGqe4g.UBr.dll
Size

1.4MB
MD5

2f7cc32eab5132846f2c60cd49b11503
SHA1

a3bd016dd1d2f26857594d4d60f36bc73e9ede99
SHA256

187754f20558b7d67abb233e84ee14a85ea1791983d87d5a4dfe062799ae3d3c
SHA512

2ad2ca1341a5603c76ee0137d88b7134aec944333c41b0aca3af3ca3415e65127225c6b1753d11bf0a1d3b570e00fa6ebb95824f09e048d13d45dfae0ef8e433
SSDEEP

24576:o9sBKJRPFHYCRNJYM9WFw7/ekQ6o2LRNtVRIO72f6hPEK3X5Kk:yhzLRQQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	5064	WerFault.exe	78

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2000	2112	cmd.exe	101
PID 2112 wrote to memory of 2000	2112	cmd.exe	101
PID 2112 wrote to memory of 3692	2112	cmd.exe	102
PID 2112 wrote to memory of 3692	2112	cmd.exe	102

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3oCGqe4g.UBr.dll,#1
1⤵
PID:5064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5064 -s 336
  2⤵
  - Program crash
  PID:1752

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 5064 -ip 5064
1⤵
PID:3540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\rundll32.exe
  rundll32 3oCGqe4g.UBr.dll,BYXjdERymsFY
  2⤵
  PID:2000
- C:\Windows\system32\rundll32.exe
  rundll32 3oCGqe4g.UBr.dll,bYXjdERymsFY
  2⤵
  PID:3692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads