Analysis
-
max time kernel
126s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
23/03/2022, 07:06
Behavioral task
behavioral1
Sample
1664-56-0x0000000000170000-0x000000000017E000-memory.dll
Resource
win7-20220311-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1664-56-0x0000000000170000-0x000000000017E000-memory.dll
Resource
win10v2004-en-20220113
0 signatures
0 seconds
General
-
Target
1664-56-0x0000000000170000-0x000000000017E000-memory.dll
-
Size
56KB
-
MD5
957bf145eb17dd1e80ffabfe9578de02
-
SHA1
ab657c6b586d17dec42482660bfcf06b3e546ae1
-
SHA256
2d54d23157e549d56edfa497620df75e4291413181f4883f91aecdfe9e38ae1a
-
SHA512
4b1a5c2288d4c8b2b6c401ee27a2fe94d080e246ea28b81fc4a78a8b94c386398f1dc04eea4894567cba514069baaae5ab208784b39b2842fe1323b15d19abf2
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4940 3688 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2816 wrote to memory of 3688 2816 rundll32.exe 79 PID 2816 wrote to memory of 3688 2816 rundll32.exe 79 PID 2816 wrote to memory of 3688 2816 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-56-0x0000000000170000-0x000000000017E000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-56-0x0000000000170000-0x000000000017E000-memory.dll,#12⤵PID:3688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 5603⤵
- Program crash
PID:4940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3688 -ip 36881⤵PID:3820