4b43ea1f3e48224734849e8e706762d4473755b911eae5319c377ac64f4d2743 | Triage

Analysis

max time kernel
4294178s
max time network
121s
platform
windows7_x64
resource
win7-20220311-en
submitted
25-03-2022 17:48

Sharing

Report Analysis Logs

General

Target

4b43ea1f3e48224734849e8e706762d4473755b911eae5319c377ac64f4d2743.dll
Size

208KB
MD5

d35a5bbdc8a7cf1f47db0a47f3a340ee
SHA1

34570b347bae863d966b66578574a5b0e4ec2da2
SHA256

4b43ea1f3e48224734849e8e706762d4473755b911eae5319c377ac64f4d2743
SHA512

c599bcf696f500773a37cdeec4f049b94a9d56b68b013782cc61447b6dbe3c8f3b3bf4a3eff9feff1359344167122b604674e017813b50d0fcf0893ca6e10722

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1824 1860 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 980 wrote to memory of 1860	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1860	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1860	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1860	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1860	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1860	980	rundll32.exe	rundll32.exe
PID 980 wrote to memory of 1860	980	rundll32.exe	rundll32.exe
PID 1860 wrote to memory of 1824	1860	rundll32.exe	WerFault.exe
PID 1860 wrote to memory of 1824	1860	rundll32.exe	WerFault.exe
PID 1860 wrote to memory of 1824	1860	rundll32.exe	WerFault.exe
PID 1860 wrote to memory of 1824	1860	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b43ea1f3e48224734849e8e706762d4473755b911eae5319c377ac64f4d2743.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b43ea1f3e48224734849e8e706762d4473755b911eae5319c377ac64f4d2743.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 244
3⤵
- Program crash
PID:1824

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-56-0x0000000000000000-mapping.dmp

Download
memory/1860-54-0x0000000000000000-mapping.dmp

Download
memory/1860-55-0x0000000075E61000-0x0000000075E63000-memory.dmp

Filesize
8KB

Download