0be905402f868d6ca92a465a5ac91cd4d8ce452afdb13ad266651c796d75021d | Triage

Analysis

max time kernel
120s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19-03-2022 09:16

Sharing

Report Analysis Logs

General

Target

0be905402f868d6ca92a465a5ac91cd4d8ce452afdb13ad266651c796d75021d.dll
Size

2.2MB
MD5

b4890fa81a5f21988e310f42e4f16b40
SHA1

14944be1c21e1712ac604e52bd5ce8370c2f5d75
SHA256

0be905402f868d6ca92a465a5ac91cd4d8ce452afdb13ad266651c796d75021d
SHA512

e8c5b199edbce0e1e502423ee1049dae06f6a311e9ac6e8a2069c3f26358c013a1e6d127d7ef950d3d7c58eb2f1ad171c90dc2a6601792dded68c671b6b397c5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4888 3672 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3864 wrote to memory of 3672	3864	rundll32.exe	rundll32.exe
PID 3864 wrote to memory of 3672	3864	rundll32.exe	rundll32.exe
PID 3864 wrote to memory of 3672	3864	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be905402f868d6ca92a465a5ac91cd4d8ce452afdb13ad266651c796d75021d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0be905402f868d6ca92a465a5ac91cd4d8ce452afdb13ad266651c796d75021d.dll,#1
2⤵
PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 604
3⤵
- Program crash
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3672 -ip 3672
1⤵
PID:3736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...