26d64a54a7d7c19a0c9c865c6ba67a4bbda227599f1e7d79e08a570637c4ea12

Analysis

max time kernel
175s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
07/03/2022, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9df30d52b9fc14a973a6de359fc32d55.exe
Size 1.1MB
Sample220307-mdny3adca8
SHA256 26d64a54a7d7c19a0c9c865c6ba67a4bbda227599f1e7d79e08a570637c4ea12
MD5 9df30d52b9fc14a973a6de359fc32d55
SHA1 142260764363f0105dd4ecdca38530f5c40d1f4a
SHA512 79c4b381c2f2ff89de2649ce314c131032950b525c162f328196a51fe4d98aa7a679445461c3f00001feb542282970a473e02894b8671d59ecf1d8dc71560bf7
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
35	4684	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4748	1044	WerFault.exe	78

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84
PID 1044 wrote to memory of 4684	1044	9df30d52b9fc14a973a6de359fc32d55.exe	84

C:\Users\Admin\AppData\Local\Temp\9df30d52b9fc14a973a6de359fc32d55.exe
"C:\Users\Admin\AppData\Local\Temp\9df30d52b9fc14a973a6de359fc32d55.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  PID:4684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 608
  2⤵
  - Program crash
  PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1044 -ip 1044
1⤵
PID:4692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-130-0x0000000002263000-0x000000000233C000-memory.dmp

Download

memory/1044-131-0x0000000002350000-0x0000000002565000-memory.dmp

Download

memory/1044-132-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/1044-133-0x0000000000400000-0x0000000000622000-memory.dmp

Download

memory/1044-134-0x0000000077890000-0x0000000077A33000-memory.dmp

Download

memory/4684-138-0x0000000000620000-0x0000000000623000-memory.dmp

Download

memory/4684-137-0x0000000075D10000-0x0000000075EB0000-memory.dmp

Download

memory/4684-136-0x0000000077890000-0x0000000077A33000-memory.dmp

Download

memory/4684-139-0x0000000000630000-0x0000000000633000-memory.dmp

Download

memory/4684-140-0x0000000000640000-0x0000000000643000-memory.dmp

Download

memory/4684-141-0x0000000000650000-0x0000000000653000-memory.dmp

Download

memory/4684-142-0x0000000000660000-0x0000000000663000-memory.dmp

Download

memory/4684-144-0x0000000000680000-0x0000000000683000-memory.dmp

Download

memory/4684-143-0x0000000000670000-0x0000000000673000-memory.dmp

Download

memory/4684-145-0x0000000000690000-0x0000000000693000-memory.dmp

Download

memory/4684-146-0x00000000006A0000-0x00000000006A3000-memory.dmp

Download

memory/4684-147-0x00000000006B0000-0x00000000006B3000-memory.dmp

Download

memory/4684-135-0x0000000000610000-0x0000000000613000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads