matanbuchus | 890ac5a5052207139cbafcfe5bd61aeb0d56539020aeb4135a61233f0ee07446

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2024, 02:05

Target
693553ae717b96b77c270f853b47fac2.dll
Size 772KB
Sample240120-cht1rsabg8
SHA256 890ac5a5052207139cbafcfe5bd61aeb0d56539020aeb4135a61233f0ee07446
MD5 693553ae717b96b77c270f853b47fac2
SHA1 5573adbf55846fb873ecf490ac7300ddec4dda01
SHA512 b5bbb1b1216007601d1db362edebf181c5607c4e88596d691f2448ac0ad07ca0de2126ff5977d9bd49a40b202e8eb8b59bf613659c48910e708be9843fb64532
SSDEEP 12288:gEIofc+w8/eAd9k7vfAcyNAgD3PkA3AX3w175AGX3My4xfXr5qnk7Nw6k2:gEIA/LdWsdNAgeXKpdcXNBhwj2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Matanbuchus
A loader sold as MaaS first seen in February 2021.
loader matanbuchus

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4384	1040	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1040	rundll32.exe
1040	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1040	2696	rundll32.exe	86
PID 2696 wrote to memory of 1040	2696	rundll32.exe	86
PID 2696 wrote to memory of 1040	2696	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\693553ae717b96b77c270f853b47fac2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\693553ae717b96b77c270f853b47fac2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1040
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 820
    3⤵
    - Program crash
    PID:4384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1040 -ip 1040
1⤵
PID:3348

memory/1040-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1040-4-0x0000000000F80000-0x0000000000F81000-memory.dmp

Download

memory/1040-5-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1040-14-0x0000000000400000-0x00000000004D8000-memory.dmp

Download