4b43ea1f3e48224734849e8e706762d4473755b911eae5319c377ac64f4d2743 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20220310-en
submitted
25-03-2022 17:48

Sharing

Report Analysis Logs

General

Target

4b43ea1f3e48224734849e8e706762d4473755b911eae5319c377ac64f4d2743.dll
Size

208KB
MD5

d35a5bbdc8a7cf1f47db0a47f3a340ee
SHA1

34570b347bae863d966b66578574a5b0e4ec2da2
SHA256

4b43ea1f3e48224734849e8e706762d4473755b911eae5319c377ac64f4d2743
SHA512

c599bcf696f500773a37cdeec4f049b94a9d56b68b013782cc61447b6dbe3c8f3b3bf4a3eff9feff1359344167122b604674e017813b50d0fcf0893ca6e10722

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2780 4060 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1500 wrote to memory of 4060	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 4060	1500	rundll32.exe	rundll32.exe
PID 1500 wrote to memory of 4060	1500	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b43ea1f3e48224734849e8e706762d4473755b911eae5319c377ac64f4d2743.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b43ea1f3e48224734849e8e706762d4473755b911eae5319c377ac64f4d2743.dll,#1
2⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 680
3⤵
- Program crash
PID:2780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4060 -ip 4060
1⤵
PID:964

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4060-134-0x0000000000000000-mapping.dmp

Download