2f3e5cb1cf503fcab6a3c326923f8e0438367ec8e1e646290b4f6ab76e07f7a2 | Triage

Analysis

max time kernel
119s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19-03-2022 09:09

Sharing

Report Analysis Logs

General

Target

2f3e5cb1cf503fcab6a3c326923f8e0438367ec8e1e646290b4f6ab76e07f7a2.dll
Size

2.2MB
MD5

9de7e94f65a3831fab75bee4e3c40915
SHA1

b54e7a138a806a6e0d4f28811b1eb2c8c45f5d33
SHA256

2f3e5cb1cf503fcab6a3c326923f8e0438367ec8e1e646290b4f6ab76e07f7a2
SHA512

98d50ba898c2c30851458e0b7cdc1c250f9185027891424d5637b5c99157e11b76f6c78d4db0cde6346f51182de9500165f49a79086dd9fb0ee0c1a8dec40168

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4172 3588 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3732 wrote to memory of 3588	3732	rundll32.exe	rundll32.exe
PID 3732 wrote to memory of 3588	3732	rundll32.exe	rundll32.exe
PID 3732 wrote to memory of 3588	3732	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f3e5cb1cf503fcab6a3c326923f8e0438367ec8e1e646290b4f6ab76e07f7a2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f3e5cb1cf503fcab6a3c326923f8e0438367ec8e1e646290b4f6ab76e07f7a2.dll,#1
2⤵
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 604
3⤵
- Program crash
PID:4172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3588 -ip 3588
1⤵
PID:4240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...