bdad8ffe6dff0480228093dccc5fe0e7b7bf1b83c3dd1666342b5a3ed0b93039 | Triage

Analysis

max time kernel
96s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2023 15:00

Sharing

Report Analysis Logs

General

Target

unrobe.dat.dll
Size

752KB
MD5

f405268ed8ec0482d4427e721cf0a042
SHA1

aff4b44552caaf0b2916095259d309e814bdb198
SHA256

bdad8ffe6dff0480228093dccc5fe0e7b7bf1b83c3dd1666342b5a3ed0b93039
SHA512

7a38c42bbef1036ae5b5aa94e7853cf72ed2c3663edf7c3ab0fa9e3d1d52c3300936e4093efb186b883ebaa3e8ce9c8007d7cf950fc5b65964ed1566e0f2b48e
SSDEEP

12288:zDxy+2MIBYYimb3oG11xfTUUk0uU7/GQ4vbnWj69N:Pg+2MIBYkb4G11hTQ05bGM

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3452	5072	WerFault.exe	81

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 5072	4812	rundll32.exe	81
PID 4812 wrote to memory of 5072	4812	rundll32.exe	81
PID 4812 wrote to memory of 5072	4812	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\unrobe.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\unrobe.dat.dll,#1
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 600
    3⤵
    - Program crash
    PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5072 -ip 5072
1⤵
PID:4776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5072-133-0x000000006AD80000-0x000000006AE22000-memory.dmp

Filesize
648KB

Download