d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa | Triage

Resubmissions

27-04-2023 15:16

230427-snnnyagc97 3

30-03-2023 10:31

230330-mkr93adg3s 10

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
27-04-2023 15:16

Sharing

Report Analysis Logs

General

Target

Beinked.Funkias.dll
Size

556KB
MD5

c9ab1cd04e796fd7f084a1dd2d40cc2d
SHA1

f05b2066a375a5c8d3dfc44d6097f577cd4f0255
SHA256

d7608b8f684e7465599a4673fefa329de646e38d934dd79e592288c68720bcfa
SHA512

ad974a30ac9e5915cb221db1c07fbaaa2d7b7f9a820841c62e887347abec76e8b626d97cfca6fb386a74f2f4bc89a4c484e46cc585770cd215e357eca0b13d9c
SSDEEP

12288:0sqXe4DNX3lWA38yEDJQTiaQS8LztCYKH5t3XjMjDW:vqXeSNX3lWA3DEeCLcYKbIj

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1984 1916 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1992 wrote to memory of 1916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1916	1992	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1916	1992	rundll32.exe	rundll32.exe
PID 1916 wrote to memory of 1984	1916	rundll32.exe	WerFault.exe
PID 1916 wrote to memory of 1984	1916	rundll32.exe	WerFault.exe
PID 1916 wrote to memory of 1984	1916	rundll32.exe	WerFault.exe
PID 1916 wrote to memory of 1984	1916	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Beinked.Funkias.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Beinked.Funkias.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 224
3⤵
- Program crash
PID:1984

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...