c5958711c87358d92b505eda53dd9f167ac6dcbc0e509b34cbf1c69e2768f46e | Triage

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2023, 12:50

Sharing

Report Analysis Logs

General

Target

Setup_Loader v2.1/PhotoBase.dll
Size

37KB
MD5

dad2758a806a22b9ec1956218c040741
SHA1

763cdf2714c232317f320eea605925fffa64c451
SHA256

931fb1c39192a82208262a13bcc28398cb3ef1995e19ea3c72fbfc4e6191f818
SHA512

78653743ef4c5bf2291a48377b0e518ef1bd545972f86d1ebb90244a79807160afc27cf09d5d05d2e94a36daef0dba3b988e8276e06810deb81f1ee7a429d384
SSDEEP

768:rKHzaXYaZrGk4qLwQWSmtoWkr/3W0Kl/5b9eV3/I:rCzaQkMQdmty+ZeBQ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	4504	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 4504	3440	rundll32.exe	85
PID 3440 wrote to memory of 4504	3440	rundll32.exe	85
PID 3440 wrote to memory of 4504	3440	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Setup_Loader v2.1\PhotoBase.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Setup_Loader v2.1\PhotoBase.dll",#1
  2⤵
  PID:4504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 612
    3⤵
    - Program crash
    PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4504 -ip 4504
1⤵
PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads