Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
25-03-2022 19:43
Static task
static1
Behavioral task
behavioral1
Sample
48117c5c3338e3ffbd9b1cc388691ccd1ef52fd1e5efc81280f50c90ac4df73b.dll
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
48117c5c3338e3ffbd9b1cc388691ccd1ef52fd1e5efc81280f50c90ac4df73b.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
48117c5c3338e3ffbd9b1cc388691ccd1ef52fd1e5efc81280f50c90ac4df73b.dll
-
Size
203KB
-
MD5
9d3c82b67fd824fed2ec9de4b7caf665
-
SHA1
e0b8dfcc664d21eda37a63f4a49853ccda9f6efa
-
SHA256
48117c5c3338e3ffbd9b1cc388691ccd1ef52fd1e5efc81280f50c90ac4df73b
-
SHA512
6bf691421b24395e5d79b25f6a46e070319c35a9cd8895ed440fe713ccda7f0c633f52e67a004de1a86a88c15e529a6d89bfc6e7ade3c8ef3d9f155d760b336f
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4180 4432 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1012 wrote to memory of 4432 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 4432 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 4432 1012 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\48117c5c3338e3ffbd9b1cc388691ccd1ef52fd1e5efc81280f50c90ac4df73b.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\48117c5c3338e3ffbd9b1cc388691ccd1ef52fd1e5efc81280f50c90ac4df73b.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 6323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4432 -ip 44321⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4432-130-0x0000000000000000-mapping.dmp