Analysis

  • max time kernel
    143s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 00:30

General

  • Target

    089ebf549a54ffd47419754b2a4a1b47.dll

  • Size

    85KB

  • MD5

    089ebf549a54ffd47419754b2a4a1b47

  • SHA1

    63150a78295cdf80445586d8e540fb8d10e51237

  • SHA256

    f685dd97966ca0db14c417cd3719cc55aad196328303a95d3f896b582b7cf2b8

  • SHA512

    0663a3ead6426768836e11bea0468356fad5672839a27653001ec279cfd15e5fb432ddf4dbaf5d7624e372c7ea73d74562dc0ac7754cce4baca717b654ec62be

  • SSDEEP

    1536:lvMHPiWVXVug0qZz3Ud7MzUwJlN3Pw8el467YbwBHq0sS9k4rk7TzrEm73L7jrVd:iaS0g0qZzkhgjlU4vbwBHQuPkfvEevmk

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\089ebf549a54ffd47419754b2a4a1b47.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:700
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\089ebf549a54ffd47419754b2a4a1b47.dll
      2⤵
        PID:4744
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 596
          3⤵
          • Program crash
          PID:3112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4744 -ip 4744
      1⤵
        PID:4992

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4744-0-0x0000000000400000-0x0000000000443000-memory.dmp

        Filesize

        268KB

      • memory/4744-1-0x0000000000400000-0x0000000000443000-memory.dmp

        Filesize

        268KB