6f5c319abad434df88f93e4068bd85781ccf125546cb6fac3b8d453b347be2f7 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 11:24

Sharing

Report Analysis Logs

General

Target

$PLUGINSDIR/Sibuia.dll
Size

524KB
MD5

6a3c3c97e92a5949f88311e80268bbb5
SHA1

48c11e3f694b468479bc2c978749d27b5d03faa2
SHA256

7938db73242aafbe80915e4ca886d38be9b7e872b93bdae1e8ee6cf4a005b7d9
SHA512

6141886a889825ccdfa59a419f7670a34ef240c4f90a83bc17223c415f2fbd983280e98e67485710e449746b5bf3284907537bef6ab698a48954dd4910ddf693
SSDEEP

12288:yFlW+6yL4qXm3e39uB9dk6M6g89vYyw7UwogmySQk9GS168q:y/L6yL44oAP7LD7UvCaGSlq

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1248 2076 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2084 wrote to memory of 2076	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2076	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2076	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2076	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2076	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2076	2084	rundll32.exe	rundll32.exe
PID 2084 wrote to memory of 2076	2084	rundll32.exe	rundll32.exe
PID 2076 wrote to memory of 1248	2076	rundll32.exe	WerFault.exe
PID 2076 wrote to memory of 1248	2076	rundll32.exe	WerFault.exe
PID 2076 wrote to memory of 1248	2076	rundll32.exe	WerFault.exe
PID 2076 wrote to memory of 1248	2076	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Sibuia.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Sibuia.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 248
3⤵
- Program crash
PID:1248

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...