f72cdd9dc87c924b0c843a5bfa14b258346405938c88679a627d26b14ed15847

Analysis

max time kernel
163s
max time network
252s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2023 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

publish/bin/libcairo-2.dll
Size

991KB
MD5

011adbf1bcf6ecf533b429ab3a06cb4f
SHA1

cc3acdcec4103e3e9bb85c1814c17704b95862db
SHA256

751c93bc9e36ee73f30d24c13729afa1e8ceb6527706b2bd23df363dd5830304
SHA512

5fa08f6b4f276fadd1a0c3b95186a46ed57ddc9d1fc4f819fa4e3845d26c58b322943f8beabd11f118b6612a202857427499ac6469b491f2dd53541a0c117db2
SSDEEP

24576:90614pb4CZNZuZ5uCkFnWXPiJ0iEmsCn3UxMTfzLz:90M4pUCTZubuIXe0iEmsCnNTfzLz

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2900 436 WerFault.exe rundll32.exe
4444 436 WerFault.exe rundll32.exe

pid	pid_target	process	target process
2900	436	WerFault.exe	rundll32.exe
4444	436	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 436 wrote to memory of 2900	436	rundll32.exe	WerFault.exe
PID 436 wrote to memory of 2900	436	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\publish\bin\libcairo-2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 436 -s 448
  2⤵
  - Program crash
  PID:2900
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 436 -s 448
  2⤵
  - Program crash
  PID:4444

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 436 -ip 436
1⤵
PID:4212

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-133-0x0000000068DC0000-0x0000000068EBE000-memory.dmp

Filesize
1016KB

Download
memory/436-134-0x0000000061440000-0x000000006145C000-memory.dmp

Filesize
112KB

Download
memory/436-135-0x0000000064F80000-0x0000000064FCE000-memory.dmp

Filesize
312KB

Download
memory/436-136-0x00000000693C0000-0x0000000069473000-memory.dmp

Filesize
716KB

Download
memory/436-137-0x0000000063500000-0x00000000635AC000-memory.dmp

Filesize
688KB

Download
memory/436-138-0x0000000068B40000-0x0000000068B80000-memory.dmp

Filesize
256KB

Download
memory/436-139-0x0000000062E80000-0x0000000062E9F000-memory.dmp

Filesize
124KB

Download
memory/436-140-0x0000000064940000-0x0000000064955000-memory.dmp

Filesize
84KB

Download
memory/436-141-0x0000000068F40000-0x0000000068F86000-memory.dmp

Filesize
280KB

Download
memory/436-142-0x0000000061CC0000-0x0000000061CE8000-memory.dmp

Filesize
160KB

Download
memory/436-143-0x0000000066000000-0x000000006610B000-memory.dmp

Filesize
1.0MB

Download
memory/436-144-0x00000000626C0000-0x00000000626DA000-memory.dmp

Filesize
104KB

Download
memory/436-145-0x0000000061600000-0x0000000061712000-memory.dmp

Filesize
1.1MB

Download
memory/436-148-0x0000000069140000-0x000000006918E000-memory.dmp

Filesize
312KB

Download
memory/436-146-0x00000000649C0000-0x0000000064AE5000-memory.dmp

Filesize
1.1MB

Download
memory/436-147-0x0000000070540000-0x000000007056D000-memory.dmp

Filesize
180KB

Download
memory/436-149-0x000000006FC40000-0x000000006FDA5000-memory.dmp

Filesize
1.4MB

Download