37007796bbcd4370c8e562d2d80f99706c5e0910d866cea567b5c5da71f3fc2c | Triage

Analysis

max time kernel
60s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 01:22

Sharing

Report Analysis Logs

General

Target

WebUI.dll
Size

459.2MB
MD5

048be900f5553091dc98681862452558
SHA1

6eeaf9f45bc758e01082b74e8c42f70bae92a3d5
SHA256

8f1fc8f317a02baa5845c85176031d1630b058c110315fbcb2a578663bcbb7ed
SHA512

cb2f7552f1efb58bb5a677362892950105bbb2a1c097378e9e05abaeb946a367a41f6b5cca21e098078fa67bff9ef6853ac27f9598f88b3b9e1e2e7e5a3ef480
SSDEEP

393216:bOuRUemcIoCD63xN4kTZlSDkGaUXcQL8qPyELSVTuGGG:a5ekv/sZIDkGaUXcQL/yJ

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2796	3604	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 3604	3296	rundll32.exe	85
PID 3296 wrote to memory of 3604	3296	rundll32.exe	85
PID 3296 wrote to memory of 3604	3296	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebUI.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\WebUI.dll,#1
  2⤵
  PID:3604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 772
    3⤵
    - Program crash
    PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3604 -ip 3604
1⤵
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3604-0-0x0000000002500000-0x0000000003500000-memory.dmp

Filesize
16.0MB

Download
memory/3604-1-0x0000000002500000-0x0000000003500000-memory.dmp

Filesize
16.0MB

Download