128ccd1c2f002c778f7de0dde147a6f1b91dbd924bb30eb7c694237392e8a4d1 | Triage

Analysis

max time kernel
4294181s
max time network
132s
platform
windows7_x64
resource
win7-20220311-en
submitted
14-03-2022 19:42

Sharing

Report Analysis Logs

General

Target

128ccd1c2f002c778f7de0dde147a6f1b91dbd924bb30eb7c694237392e8a4d1.dll
Size

211KB
MD5

c33760e95e14b20eee09f3f6cd5b7c5a
SHA1

075532e074e6b0e0b9c725fabe2179de6ea9675f
SHA256

128ccd1c2f002c778f7de0dde147a6f1b91dbd924bb30eb7c694237392e8a4d1
SHA512

51d7cbdc689a48db24ef4c4101fc193e8413b8209a698b6ffb46eb0be2a9c14c6c9005d88c6907821cbe12ba7e4f0fceeefff46b8e360a05bea51aa6f89fc7c2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 1168 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1328 wrote to memory of 1168	1328	rundll32.exe	rundll32.exe
PID 1168 wrote to memory of 2008	1168	rundll32.exe	WerFault.exe
PID 1168 wrote to memory of 2008	1168	rundll32.exe	WerFault.exe
PID 1168 wrote to memory of 2008	1168	rundll32.exe	WerFault.exe
PID 1168 wrote to memory of 2008	1168	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\128ccd1c2f002c778f7de0dde147a6f1b91dbd924bb30eb7c694237392e8a4d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\128ccd1c2f002c778f7de0dde147a6f1b91dbd924bb30eb7c694237392e8a4d1.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 244
3⤵
- Program crash
PID:2008

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download