Analysis

  • max time kernel
    126s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    23/03/2022, 07:06

General

  • Target

    1664-56-0x0000000000170000-0x000000000017E000-memory.dll

  • Size

    56KB

  • MD5

    957bf145eb17dd1e80ffabfe9578de02

  • SHA1

    ab657c6b586d17dec42482660bfcf06b3e546ae1

  • SHA256

    2d54d23157e549d56edfa497620df75e4291413181f4883f91aecdfe9e38ae1a

  • SHA512

    4b1a5c2288d4c8b2b6c401ee27a2fe94d080e246ea28b81fc4a78a8b94c386398f1dc04eea4894567cba514069baaae5ab208784b39b2842fe1323b15d19abf2

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-56-0x0000000000170000-0x000000000017E000-memory.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\1664-56-0x0000000000170000-0x000000000017E000-memory.dll,#1
      2⤵
        PID:3688
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 560
          3⤵
          • Program crash
          PID:4940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3688 -ip 3688
      1⤵
        PID:3820

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads