matanbuchus | 49284eb85d58dbe31d8da683a85a0a09eae81d438f2ec23524ef775018e31aa3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 21:13

Target

f87f4fdefab5ae7d4c852b2e4c125b5a.dll
Size

570KB
MD5

f87f4fdefab5ae7d4c852b2e4c125b5a
SHA1

4c38b775024c4b7f20a082a6ade3c583f046285f
SHA256

49284eb85d58dbe31d8da683a85a0a09eae81d438f2ec23524ef775018e31aa3
SHA512

5f0d6439607666a493c40cc00536808c5d726b25b72b9272771438d3d94b4ab41a9b4a96e45a37d55788eec8c17ebb63caa35075422bdfe1d8a3697fea0785ec
SSDEEP

12288:TQJkUW20CjBwC0PSDdSLxQgOUtdByJxcU5InnykeyCgw:kJnf0CiC0Cd+6vwQL

Score

10^/10

Family

matanbuchus

http://45.93.201.209/update/31359/8108.svg

http://45.93.201.209/update/85943897/xpth8.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2720	1836	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	Process	procid_target
PID 3484 wrote to memory of 1836	3484	regsvr32.exe	14
PID 3484 wrote to memory of 1836	3484	regsvr32.exe	14
PID 3484 wrote to memory of 1836	3484	regsvr32.exe	14

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\f87f4fdefab5ae7d4c852b2e4c125b5a.dll
1⤵
PID:1836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1100
  2⤵
  - Program crash
  PID:2720

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\f87f4fdefab5ae7d4c852b2e4c125b5a.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1836 -ip 1836
1⤵
PID:4656

memory/1836-0-0x0000000010000000-0x00000000100DA000-memory.dmp

Filesize
872KB

Download
memory/1836-2-0x0000000010000000-0x00000000100DA000-memory.dmp

Filesize
872KB

Download
memory/1836-1-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/1836-3-0x0000000010000000-0x00000000100DA000-memory.dmp

Filesize
872KB

Download
memory/1836-4-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Filesize
4KB

Download
memory/1836-12-0x0000000010000000-0x00000000100DA000-memory.dmp

Filesize
872KB

Download
memory/1836-15-0x0000000010000000-0x00000000100DA000-memory.dmp

Filesize
872KB

Download