Analysis

  • max time kernel
    126s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    21-03-2022 19:30

General

  • Target

    1752-55-0x0000000180000000-0x000000018000B000-memory.dll

  • Size

    44KB

  • MD5

    26c5fca101a362c8a0bbeefbf08da798

  • SHA1

    264bca602e7fd7c38045446802d548f4d116c300

  • SHA256

    e1dbfbc85b8b435d91e798b5f88f1bbf5d406647b473d89b3d60465e28feba1b

  • SHA512

    592b414a77519dd7fe344890dca891b4fbb3c6fea0479352deb0be2dcdb320ccbd9e103d573b6fb2837761452907e5f26aaf92d765b0ee858f9de881d60ceb2f

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 62 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1752-55-0x0000000180000000-0x000000018000B000-memory.dll,#1
    1⤵
      PID:4336
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 4336 -s 244
        2⤵
        • Program crash
        PID:4516
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 184 -p 4336 -ip 4336
      1⤵
        PID:4728
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
        1⤵
        • Drops file in Windows directory
        PID:1204

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1204-134-0x00000219F1960000-0x00000219F1970000-memory.dmp

        Filesize

        64KB

      • memory/1204-135-0x00000219F19C0000-0x00000219F19D0000-memory.dmp

        Filesize

        64KB

      • memory/1204-136-0x00000219F3F60000-0x00000219F3F64000-memory.dmp

        Filesize

        16KB

      • memory/1204-137-0x00000219F4560000-0x00000219F4564000-memory.dmp

        Filesize

        16KB

      • memory/1204-138-0x00000219F4560000-0x00000219F4564000-memory.dmp

        Filesize

        16KB

      • memory/1204-139-0x00000219F46B0000-0x00000219F46B4000-memory.dmp

        Filesize

        16KB

      • memory/1204-140-0x00000219F46B0000-0x00000219F46B4000-memory.dmp

        Filesize

        16KB

      • memory/1204-141-0x00000219F46F0000-0x00000219F46F4000-memory.dmp

        Filesize

        16KB

      • memory/1204-142-0x00000219F4670000-0x00000219F4674000-memory.dmp

        Filesize

        16KB