b2ea7420a0aca519c021269ea046802d83f2f3833f6584b46c6efcebb697868e | Triage

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
20/05/2023, 18:33

Sharing

Report Analysis Logs

General

Target

unrar.dll
Size

301KB
MD5

e38c2d805197fa2f4cfe66ddcd582849
SHA1

65adc519b4bb4bae2c6257d3c8729b99b5ffe678
SHA256

6bd635ad27c94e7522fc1f5f4b076c4faa6dbb9cd044623cb350f730435bb292
SHA512

6149ba8e445a230c3618a9c6b468b7880d47e194dbf070275f25acb455b85676095e25fa278fc02873a8edd1b1f71eb223a950bcd875cd5ef85a81c9abc89709
SSDEEP

6144:FVE2HL1SRRSYyGo6xd2BwhM5gmVH3MZ1whMnX8:Fq2H4RYGBGBwhl3whMX

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	1444	WerFault.exe	24

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1692	1444	rundll32.exe	27
PID 1444 wrote to memory of 1692	1444	rundll32.exe	27
PID 1444 wrote to memory of 1692	1444	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unrar.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1444 -s 92
  2⤵
  - Program crash
  PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads