12d32581acbfcfe59576440e3f182c098c29a0f1735efe7452690a686123fce1 | Triage

Analysis

max time kernel
429s
max time network
441s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
02/08/2023, 23:39

Sharing

Report Analysis Logs

General

Target

Common Files/BStorage.dll
Size

36KB
MD5

7bbce60e5874ea605f4d3f275b277f9d
SHA1

151cf2463098411b4c7ee1d5c2606b5b56dc50f0
SHA256

294861f405b78ae35a7a245b94a375a13c9e8b96efa65c8a8270e74f0f1c89bc
SHA512

2ef6e72185e0586f1b77bb828ad91244afe28f06c708555193cbbfaec5cac1ddf2cace9328a22d508d599d697ac574fe7b83bebed0eb92ef18f6c07de29ea6f8
SSDEEP

384:9/ywquJ/pyUHGYTObY0ALP4iVwkOjaWquaI+Sn:BpOUHGYcBAj4ijOOWquaHSn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3372	2524	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2524	1576	rundll32.exe	85
PID 1576 wrote to memory of 2524	1576	rundll32.exe	85
PID 1576 wrote to memory of 2524	1576	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\BStorage.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Common Files\BStorage.dll",#1
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 644
    3⤵
    - Program crash
    PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2524 -ip 2524
1⤵
PID:3276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2524-133-0x00000000008F0000-0x0000000000909000-memory.dmp

Filesize
100KB

Download