37007796bbcd4370c8e562d2d80f99706c5e0910d866cea567b5c5da71f3fc2c | Triage

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 01:22

Sharing

Report Analysis Logs

General

Target

WebUI.dll
Size

459.2MB
MD5

048be900f5553091dc98681862452558
SHA1

6eeaf9f45bc758e01082b74e8c42f70bae92a3d5
SHA256

8f1fc8f317a02baa5845c85176031d1630b058c110315fbcb2a578663bcbb7ed
SHA512

cb2f7552f1efb58bb5a677362892950105bbb2a1c097378e9e05abaeb946a367a41f6b5cca21e098078fa67bff9ef6853ac27f9598f88b3b9e1e2e7e5a3ef480
SSDEEP

393216:bOuRUemcIoCD63xN4kTZlSDkGaUXcQL8qPyELSVTuGGG:a5ekv/sZIDkGaUXcQL/yJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2848	1196	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1196	2296	rundll32.exe	28
PID 2296 wrote to memory of 1196	2296	rundll32.exe	28
PID 2296 wrote to memory of 1196	2296	rundll32.exe	28
PID 2296 wrote to memory of 1196	2296	rundll32.exe	28
PID 2296 wrote to memory of 1196	2296	rundll32.exe	28
PID 2296 wrote to memory of 1196	2296	rundll32.exe	28
PID 2296 wrote to memory of 1196	2296	rundll32.exe	28
PID 1196 wrote to memory of 2848	1196	rundll32.exe	29
PID 1196 wrote to memory of 2848	1196	rundll32.exe	29
PID 1196 wrote to memory of 2848	1196	rundll32.exe	29
PID 1196 wrote to memory of 2848	1196	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebUI.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 300
    3⤵
    - Program crash
    PID:2848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-0-0x0000000002180000-0x0000000003180000-memory.dmp

Filesize
16.0MB

Download
memory/1196-1-0x0000000002180000-0x0000000003180000-memory.dmp

Filesize
16.0MB

Download