Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 16:31

General

  • Target

    Archivarius 3000/AI.dll

  • Size

    134KB

  • MD5

    8e62bae2e4487a9df1494fb683ff4415

  • SHA1

    4af19c3f94cbb2040ffe67ada0801896a5572554

  • SHA256

    fb5118df0d5bd5a498e1bb027e4a53684f8792524e79ed275e6be53d62be5f4d

  • SHA512

    d6c0082326db7c763ca64c28394cd3a5e38ea1c9eb4b808c329403ec61f144348e58ccab9bdc00577da5ceea0c7039bedcf44639d975599f88c5d7619a96227c

  • SSDEEP

    3072:w4QD5C5zDLZdqWbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU71jEJ:w4QdC5DzqYwvP6bQ7yMP+DE8271jEJ

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Modifies registry class 42 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Archivarius 3000\AI.dll",#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3384
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Archivarius 3000\AI.dll",#1
      2⤵
      • Modifies registry class
      PID:2188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 680
        3⤵
        • Program crash
        PID:4080
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2188 -ip 2188
    1⤵
      PID:3600

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2188-1-0x0000000002BB0000-0x0000000002BE0000-memory.dmp

      Filesize

      192KB

    • memory/2188-0-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/2188-2-0x0000000002D20000-0x0000000002D22000-memory.dmp

      Filesize

      8KB

    • memory/2188-8-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

      Filesize

      4KB

    • memory/2188-7-0x0000000002E70000-0x0000000002E71000-memory.dmp

      Filesize

      4KB

    • memory/2188-6-0x0000000002E80000-0x0000000002E81000-memory.dmp

      Filesize

      4KB

    • memory/2188-5-0x0000000002E90000-0x0000000002E91000-memory.dmp

      Filesize

      4KB

    • memory/2188-4-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

      Filesize

      4KB

    • memory/2188-3-0x00000000013F0000-0x00000000013F1000-memory.dmp

      Filesize

      4KB

    • memory/2188-11-0x0000000002BB0000-0x0000000002BE0000-memory.dmp

      Filesize

      192KB

    • memory/2188-10-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB