ad9e22bfc5ea15bdd801ee5d00575f8c3d3e6e62defc46b139ab91ca04c1ab35 | Triage

Analysis

max time kernel
233s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20230220-ja
resource tags

arch:x64arch:x86image:win10v2004-20230220-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
24/04/2023, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

K7UI.dll
Size

100KB
MD5

773160f2618711ba74012622147c84e0
SHA1

a7a5f3beb7c0424b7a509fe3b5933d557bee5575
SHA256

3b195a8aa292fdc61d76fa0aa7634d2eb922b787c48e9c4909765d6c4a25aea0
SHA512

79109c6794015545d7d4a9dc33dbe1b798d7ae867d545f3152593014f43133a7e7c0d6860fb9ea70bd5f2997951aaede97cfb8928586d7c8395137a92edbeb6b
SSDEEP

3072:tdmAFN6g4tFmFG5dT3IisD2/pp7QHeaiBCpfhRFEDgiw:PteFGG/ciE2/ppMHOBCigh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3424	2692	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 2692	4648	rundll32.exe	85
PID 4648 wrote to memory of 2692	4648	rundll32.exe	85
PID 4648 wrote to memory of 2692	4648	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\K7UI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\K7UI.dll,#1
  2⤵
  PID:2692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 572
    3⤵
    - Program crash
    PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2692 -ip 2692
1⤵
PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads