bdb39f248d0cd06c086b5e38a8120fa4feb9208a4236f32b23e601a4037be416 | Triage

Resubmissions

21-08-2023 15:40

230821-s39vqadh37 10

11-08-2023 19:23

230811-x36khsac6w 10

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
11-08-2023 19:23

Sharing

Report Analysis Logs

General

Target

Predictor V6.3/api-ms-win-crt-conio-l1-1-0.dll
Size

19KB
MD5

6c88d0006cf852f2d8462dfa4e9ca8d1
SHA1

49002b58cb0df2ee8d868dec335133cf225657df
SHA256

d5960c7356e8ab97d0ad77738e18c80433da277671a6e89a943c7f7257ff3663
SHA512

d081843374a43d2e9b33904d4334d49383df04ee7143a8b49600841ece844eff4e8e36b4b5966737ac931ed0350f202270e043f7003bf2748c5418d5e21c2a27
SSDEEP

384:J1W1hWA5OZkum0GftpBjNuCm3Sbsl4aRGWDk:JM7oViKCPpt

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3012 2596 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2596 wrote to memory of 3012	2596	rundll32.exe	WerFault.exe
PID 2596 wrote to memory of 3012	2596	rundll32.exe	WerFault.exe
PID 2596 wrote to memory of 3012	2596	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Predictor V6.3\api-ms-win-crt-conio-l1-1-0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2596 -s 84
2⤵
- Program crash
PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads