53e705c56ff89ab514519a0a8be6727593e754004aff0fec0b58efb5a41c12ac | Triage

Resubmissions

14/06/2023, 09:27

230614-leqzdafd84 10

14/06/2023, 09:08

230614-k3wdbsfc46 3

13/06/2023, 17:04

230613-vk87kshd62 3

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2023, 17:04

Sharing

Report Analysis Logs

General

Target

borisOutOFControl.dat.dll
Size

513KB
MD5

3b04f228ba4ffab9c470a17ddb5eccef
SHA1

09668a0fee892222ffa07bbbfc0dc2731d6509c5
SHA256

53e705c56ff89ab514519a0a8be6727593e754004aff0fec0b58efb5a41c12ac
SHA512

13a434aec41550f3d91ab0bc272486513c998a4b3dde73caefc5eea83819cce3e6cf47f7cf85c75dec3827ec543590bab0866516bf4ae8a26e1133af29c4e4c5
SSDEEP

12288:xspsY6tHFBPl7rNu5bZHZ95gjyIaa0Pxg:xspsY6tHFBd7rIl175gjyIl0O

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1068	2348	WerFault.exe	84

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2348	1464	rundll32.exe	84
PID 1464 wrote to memory of 2348	1464	rundll32.exe	84
PID 1464 wrote to memory of 2348	1464	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\borisOutOFControl.dat.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\borisOutOFControl.dat.dll,#1
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 600
    3⤵
    - Program crash
    PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2348 -ip 2348
1⤵
PID:4780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-133-0x0000000066240000-0x00000000662C3000-memory.dmp

Filesize
524KB

Download