961390888afda6269362287b0f909967d507bfe4d3a0926de52933cd75314a85 | Triage

Analysis

max time kernel
437s
max time network
446s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2023, 13:35

Sharing

Report Analysis Logs

General

Target

VAMPSET v2.2.206 - Lite/libxml2.dll
Size

964KB
MD5

7ee993251d55a2eab74340d27ff82260
SHA1

15975f2aaf1dab31a7b22af068b531d806bf337e
SHA256

20e6d1109016042147a058f5ec45f0bcd58c290a89380e4d9ec467e98f0d99ca
SHA512

b9c1bf31272dda582ec05d4bd7dd4575962d4c7ac13867785104866cd42b481320368fd9a7a36ae2ebea38edc726e48ceeaa3d33bd70020fbff9afa64d561f05
SSDEEP

24576:hLcKcC0rO2s6c0k0/BMeJywAqiyOJUME:RMncDZQizS

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4968	2052	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 2052	1356	rundll32.exe	82
PID 1356 wrote to memory of 2052	1356	rundll32.exe	82
PID 1356 wrote to memory of 2052	1356	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VAMPSET v2.2.206 - Lite\libxml2.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VAMPSET v2.2.206 - Lite\libxml2.dll",#1
  2⤵
  PID:2052
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 616
    3⤵
    - Program crash
    PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2052 -ip 2052
1⤵
PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2052-0-0x0000000002700000-0x00000000027D9000-memory.dmp

Filesize
868KB

Download