10df554cb7248b3b04b8080cdd14494f1cdc5d5b838d73edc5778dc5d15f7096 | Triage

Analysis

max time kernel
4294183s
max time network
136s
platform
windows7_x64
resource
win7-20220310-en
submitted
14-03-2022 20:42

Sharing

Report Analysis Logs

General

Target

10df554cb7248b3b04b8080cdd14494f1cdc5d5b838d73edc5778dc5d15f7096.dll
Size

208KB
MD5

122a89630ff881941bd27981993bea19
SHA1

d7d61a333b857df377509201570102768a3bb60e
SHA256

10df554cb7248b3b04b8080cdd14494f1cdc5d5b838d73edc5778dc5d15f7096
SHA512

db156f3154709457f47c42a1da36217fb63496a096e2f5169fc2d90ae33bdf038b7aad7c3126f30b80dfd008b4730c9b9c55dda09d18c4c0ef1d70ee48ccb8e4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1136 2040 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 836 wrote to memory of 2040	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2040	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2040	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2040	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2040	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2040	836	rundll32.exe	rundll32.exe
PID 836 wrote to memory of 2040	836	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1136	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1136	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1136	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1136	2040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10df554cb7248b3b04b8080cdd14494f1cdc5d5b838d73edc5778dc5d15f7096.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\10df554cb7248b3b04b8080cdd14494f1cdc5d5b838d73edc5778dc5d15f7096.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 244
3⤵
- Program crash
PID:1136

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download