Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220331-en -
submitted
08-04-2022 14:54
Static task
static1
Behavioral task
behavioral1
Sample
1816-58-0x00000000024A0000-0x000000000252F000-memory.dll
Resource
win7-20220331-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1816-58-0x00000000024A0000-0x000000000252F000-memory.dll
Resource
win10v2004-20220331-en
0 signatures
0 seconds
General
-
Target
1816-58-0x00000000024A0000-0x000000000252F000-memory.dll
-
Size
572KB
-
MD5
aebd3733adfc8890df5447d275cab924
-
SHA1
2ff8459dd5f307ce6e44f0f51a690dc52e958b73
-
SHA256
d5ab2c587b838441e914cd5216536a43140916f942cdd45b40e27d4995292b11
-
SHA512
7b0e021a1d8a181bd547e2777c0d5d9698bdacec756ee0b66566717c1ad6ab1876c736a63846305405644ad7125b4d8e886a892a640ebadfe37b4832ed143b73
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 996 1968 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1896 wrote to memory of 1968 1896 rundll32.exe rundll32.exe PID 1896 wrote to memory of 1968 1896 rundll32.exe rundll32.exe PID 1896 wrote to memory of 1968 1896 rundll32.exe rundll32.exe PID 1896 wrote to memory of 1968 1896 rundll32.exe rundll32.exe PID 1896 wrote to memory of 1968 1896 rundll32.exe rundll32.exe PID 1896 wrote to memory of 1968 1896 rundll32.exe rundll32.exe PID 1896 wrote to memory of 1968 1896 rundll32.exe rundll32.exe PID 1968 wrote to memory of 996 1968 rundll32.exe WerFault.exe PID 1968 wrote to memory of 996 1968 rundll32.exe WerFault.exe PID 1968 wrote to memory of 996 1968 rundll32.exe WerFault.exe PID 1968 wrote to memory of 996 1968 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1816-58-0x00000000024A0000-0x000000000252F000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1816-58-0x00000000024A0000-0x000000000252F000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 1963⤵
- Program crash