bdad8ffe6dff0480228093dccc5fe0e7b7bf1b83c3dd1666342b5a3ed0b93039 | Triage

Analysis

max time kernel
140s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02/06/2023, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

unrobe.dat.dll
Size

752KB
MD5

f405268ed8ec0482d4427e721cf0a042
SHA1

aff4b44552caaf0b2916095259d309e814bdb198
SHA256

bdad8ffe6dff0480228093dccc5fe0e7b7bf1b83c3dd1666342b5a3ed0b93039
SHA512

7a38c42bbef1036ae5b5aa94e7853cf72ed2c3663edf7c3ab0fa9e3d1d52c3300936e4093efb186b883ebaa3e8ce9c8007d7cf950fc5b65964ed1566e0f2b48e
SSDEEP

12288:zDxy+2MIBYYimb3oG11xfTUUk0uU7/GQ4vbnWj69N:Pg+2MIBYkb4G11hTQ05bGM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1676	1572	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1572	1644	rundll32.exe	28
PID 1644 wrote to memory of 1572	1644	rundll32.exe	28
PID 1644 wrote to memory of 1572	1644	rundll32.exe	28
PID 1644 wrote to memory of 1572	1644	rundll32.exe	28
PID 1644 wrote to memory of 1572	1644	rundll32.exe	28
PID 1644 wrote to memory of 1572	1644	rundll32.exe	28
PID 1644 wrote to memory of 1572	1644	rundll32.exe	28
PID 1572 wrote to memory of 1676	1572	rundll32.exe	29
PID 1572 wrote to memory of 1676	1572	rundll32.exe	29
PID 1572 wrote to memory of 1676	1572	rundll32.exe	29
PID 1572 wrote to memory of 1676	1572	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unrobe.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\unrobe.dat.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 228
    3⤵
    - Program crash
    PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-54-0x000000006AD80000-0x000000006AE22000-memory.dmp

Filesize
648KB

Download