matanbuchus | 890ac5a5052207139cbafcfe5bd61aeb0d56539020aeb4135a61233f0ee07446

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2024, 02:05

Target

693553ae717b96b77c270f853b47fac2.dll
Size

772KB
MD5

693553ae717b96b77c270f853b47fac2
SHA1

5573adbf55846fb873ecf490ac7300ddec4dda01
SHA256

890ac5a5052207139cbafcfe5bd61aeb0d56539020aeb4135a61233f0ee07446
SHA512

b5bbb1b1216007601d1db362edebf181c5607c4e88596d691f2448ac0ad07ca0de2126ff5977d9bd49a40b202e8eb8b59bf613659c48910e708be9843fb64532
SSDEEP

12288:gEIofc+w8/eAd9k7vfAcyNAgD3PkA3AX3w175AGX3My4xfXr5qnk7Nw6k2:gEIA/LdWsdNAgeXKpdcXNBhwj2

Score

10^/10

Family

matanbuchus

http://allupdateinstall.at/www/update/v11.0/appconfig.xml

http://deylyupdateinstallversionsoft.com/www/update/v11.0/appconfig.xml

http://bestinstallversion.com/www/update/v11.0/appconfig.xml

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4384	1040	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1040	rundll32.exe
1040	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1040	2696	rundll32.exe	86
PID 2696 wrote to memory of 1040	2696	rundll32.exe	86
PID 2696 wrote to memory of 1040	2696	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\693553ae717b96b77c270f853b47fac2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\693553ae717b96b77c270f853b47fac2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 820
    3⤵
    - Program crash
    PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1040 -ip 1040
1⤵
PID:3348

memory/1040-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1040-4-0x0000000000F80000-0x0000000000F81000-memory.dmp

Filesize
4KB

Download
memory/1040-5-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1040-14-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download