f9de69f500316f89884b9809943388ea1c7bab6e9164316f9e880e4bbc2fa469 | Triage

Analysis

max time kernel
82s
max time network
270s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2023 14:33

Sharing

Report Analysis Logs

General

Target

MiniUpdate/MHPClient.dll
Size

702KB
MD5

1f10c8008934c0cc2efd274d81fb5704
SHA1

0002902623d18154a3e3c59ef497378598c03bd3
SHA256

011e21d2084750a9c04693505127d9eb08ff7ac2b04dc20a2881b1b5912a1d3e
SHA512

c116a192a50d27c2dd87d6aa6bfe66e20b0bc629feaceec66c6c187397ab30ffdb0e2e3ecb96b015e899c0f86f7270517e6d24716a17a6ecfd0f2a72b14a6ced
SSDEEP

6144:hG1kLvclLmFFWr+YOZQSYyVZ+vKD0fWQ8E6C4XIkWy7pZGx:SkLvcliFF2+OyHDwWQ8VX/v4x

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2696	4360	WerFault.exe	86

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 584 wrote to memory of 4360	584	rundll32.exe	86
PID 584 wrote to memory of 4360	584	rundll32.exe	86
PID 584 wrote to memory of 4360	584	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MiniUpdate\MHPClient.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MiniUpdate\MHPClient.dll,#1
  2⤵
  PID:4360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 584
    3⤵
    - Program crash
    PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4360 -ip 4360
1⤵
PID:4244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads