62312c9fa7b562280153bc606e626813d4404c50e341df1f992c3a6f632c3561 | Triage

Analysis

max time kernel
4294180s
max time network
122s
platform
windows7_x64
resource
win7-20220311-en
submitted
23-03-2022 05:15

Sharing

Report Analysis Logs

General

Target

792-55-0x0000000180000000-0x000000018000B000-memory.dll
Size

44KB
MD5

cc244c3571088d70605452d5b3cdd99d
SHA1

059bc679eb79ef7224eb206da4ce1c8352f68fac
SHA256

62312c9fa7b562280153bc606e626813d4404c50e341df1f992c3a6f632c3561
SHA512

770d70d5975a49e07d29d9d9458e9ae72d5d3326216f5d15d0d0c953a39e45d9c310013e36ba488303f7d16e1153d8a5807d417ad5464bf40d9b7b396285e0f2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

792 1132 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1132 wrote to memory of 792	1132	rundll32.exe	WerFault.exe
PID 1132 wrote to memory of 792	1132	rundll32.exe	WerFault.exe
PID 1132 wrote to memory of 792	1132	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\792-55-0x0000000180000000-0x000000018000B000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1132

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1132 -s 56
2⤵
- Program crash
PID:792

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-54-0x0000000000000000-mapping.dmp

Download