72bc6f8e78f8eac529d0af0abdedfc86858f6ea1c9f43aa16e6b560343171f05

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2023, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72bc6f8e78f8eac529d0af0abdedfc86858f6ea1c9f43aa16e6b560343171f05.exe
Size

3.4MB
MD5

98e4420343b3bbca65e43ff3995d77a4
SHA1

3d98e8501a024dbb0821d73c480f49858f5b4aab
SHA256

72bc6f8e78f8eac529d0af0abdedfc86858f6ea1c9f43aa16e6b560343171f05
SHA512

5f037dd6476ca4e5b0fa38069efec8cba26e5e7a981931c01f170d9168714124d8e325e6167074552796b7b79878f323a668c5adaa16511023a8b4d7eade4b1d
SSDEEP

98304:gXiavSeLfj2Xq4nIGuvsVRDBu3BbyQmldc:gXfaeLyXbIjoY3BOQY

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3268	rundll32.exe
3268	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
884	1740	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 3268	1740	72bc6f8e78f8eac529d0af0abdedfc86858f6ea1c9f43aa16e6b560343171f05.exe	84
PID 1740 wrote to memory of 3268	1740	72bc6f8e78f8eac529d0af0abdedfc86858f6ea1c9f43aa16e6b560343171f05.exe	84
PID 1740 wrote to memory of 3268	1740	72bc6f8e78f8eac529d0af0abdedfc86858f6ea1c9f43aa16e6b560343171f05.exe	84

C:\Users\Admin\AppData\Local\Temp\72bc6f8e78f8eac529d0af0abdedfc86858f6ea1c9f43aa16e6b560343171f05.exe
"C:\Users\Admin\AppData\Local\Temp\72bc6f8e78f8eac529d0af0abdedfc86858f6ea1c9f43aa16e6b560343171f05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Eptryroq.dll,start
  2⤵
  - Loads dropped DLL
  PID:3268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 560
  2⤵
  - Program crash
  PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1740 -ip 1740
1⤵
PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Eptryroq.dll

Filesize
3.3MB

MD5
bfbab3a22c45547312de1354f22d5ddd

SHA1
1a6d04d035e8d7bea47434d56cfbc77efea70f26

SHA256
c83799d9c398d39734338c55b76c95e482cfc40a388f34685f1887999ad49b18

SHA512
5faae7b64a3509e37576078d3e2bfd78ac5a63fb88b866f31d043f91a496ebdb688b2282bd57c5238eb513a57cd73ccfa3a7837214b6958a10ebfa643f7d33fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Eptryroq.dll

Filesize
3.3MB

MD5
bfbab3a22c45547312de1354f22d5ddd

SHA1
1a6d04d035e8d7bea47434d56cfbc77efea70f26

SHA256
c83799d9c398d39734338c55b76c95e482cfc40a388f34685f1887999ad49b18

SHA512
5faae7b64a3509e37576078d3e2bfd78ac5a63fb88b866f31d043f91a496ebdb688b2282bd57c5238eb513a57cd73ccfa3a7837214b6958a10ebfa643f7d33fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Eptryroq.dll

Filesize
3.3MB

MD5
bfbab3a22c45547312de1354f22d5ddd

SHA1
1a6d04d035e8d7bea47434d56cfbc77efea70f26

SHA256
c83799d9c398d39734338c55b76c95e482cfc40a388f34685f1887999ad49b18

SHA512
5faae7b64a3509e37576078d3e2bfd78ac5a63fb88b866f31d043f91a496ebdb688b2282bd57c5238eb513a57cd73ccfa3a7837214b6958a10ebfa643f7d33fa

Download Submit
memory/1740-141-0x0000000000400000-0x0000000000C31000-memory.dmp

Filesize
8.2MB

Download
memory/1740-134-0x0000000002F70000-0x000000000348B000-memory.dmp

Filesize
5.1MB

Download
memory/1740-142-0x0000000002F70000-0x000000000348B000-memory.dmp

Filesize
5.1MB

Download
memory/3268-143-0x0000000002510000-0x000000000286B000-memory.dmp

Filesize
3.4MB

Download
memory/3268-140-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/3268-139-0x0000000002510000-0x000000000286B000-memory.dmp

Filesize
3.4MB

Download
memory/3268-144-0x0000000002510000-0x000000000286B000-memory.dmp

Filesize
3.4MB

Download
memory/3268-146-0x0000000002510000-0x000000000286B000-memory.dmp

Filesize
3.4MB

Download
memory/3268-148-0x0000000002510000-0x000000000286B000-memory.dmp

Filesize
3.4MB

Download
memory/3268-149-0x0000000002510000-0x000000000286B000-memory.dmp

Filesize
3.4MB

Download
memory/3268-151-0x0000000002510000-0x000000000286B000-memory.dmp

Filesize
3.4MB

Download
memory/3268-152-0x0000000002510000-0x000000000286B000-memory.dmp

Filesize
3.4MB

Download
memory/3268-154-0x0000000002510000-0x000000000286B000-memory.dmp

Filesize
3.4MB

Download
memory/3268-155-0x0000000002510000-0x000000000286B000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads