b9dc0bb16ff8f763ddf28513308c4b5fb89795e3afb36bc8aca2d41e408b55f4 | Triage

Analysis

max time kernel
141s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 04:17

Sharing

Report Analysis Logs

General

Target

UsbEAm Hosts Editor-v3.63/gzip.dll
Size

29KB
MD5

8b3591965f623b219c0c528153746cab
SHA1

020961494fa0e08779b7aacf4422269935354f7d
SHA256

97ea3d99cf21123bc1aec72f9ded6a51ac659830392adfefd424eb799ab0219e
SHA512

6e547197d160c9ec13cf2384add1bb6753276e3dab97d951adba9257d6bf999720635a7b9d94a5ca8b94bdda2f25f36c5938d126bc3e46a358e1fad072132351
SSDEEP

768:T5aM3xJoa/eBmLnw7w4/Y5C81G1ky6lHA6St:d5Joa/eIH4/Y55JvHAh

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1576	888	WerFault.exe	16

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 888	3444	rundll32.exe	16
PID 3444 wrote to memory of 888	3444	rundll32.exe	16
PID 3444 wrote to memory of 888	3444	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\UsbEAm Hosts Editor-v3.63\gzip.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\UsbEAm Hosts Editor-v3.63\gzip.dll",#1
  2⤵
  PID:888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 600
    3⤵
    - Program crash
    PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 888 -ip 888
1⤵
PID:2420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads