55453f794fbc569bf4afdf593aa27ff863bf1e1c67c7ccb5eb7bf48f29ff0de4 | Triage

Analysis

max time kernel
315s
max time network
399s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30/05/2024, 09:46

Sharing

Report Analysis Logs

General

Target

$SYSDIR/CFCA_HSBC_LIB.dll
Size

257KB
MD5

562ec71ced3842116f7addb2d78cdc4e
SHA1

e34b01795e025d6e83a82a805e5d2ab6d0022c2d
SHA256

58fa342fb8aa5b4dd6c70e7ac6be69fd892fbfb6dff7dc499fec9b0fad8fe00e
SHA512

354ab59d0eda6fbbc05989f4eb114f2877a3f27ac7f72a614ae3d2a06b2368d244528e71f376862e6ecf6f0b272a454cc9228c74c81dd2108a30ba993c144508
SSDEEP

6144:91mvTKTVTFHqt0XsjSeSt9wYlFvDeKW1FdI5MZ:91YGxJ7cBSvDejFdr

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4256	4628	WerFault.exe	72

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4628	4184	rundll32.exe	72
PID 4184 wrote to memory of 4628	4184	rundll32.exe	72
PID 4184 wrote to memory of 4628	4184	rundll32.exe	72

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\CFCA_HSBC_LIB.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\CFCA_HSBC_LIB.dll,#1
  2⤵
  PID:4628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 636
    3⤵
    - Program crash
    PID:4256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads