03b6f8437c5c2001f1d6ff033d25a73adc37c9ba778e7706b02b181ccab1d5c3 | Triage

Analysis

max time kernel
29s
max time network
47s
platform
windows7_x64
resource
win7-20220331-en
submitted
08-04-2022 15:34

Sharing

Report Analysis Logs

General

Target

1340-58-0x0000000000D60000-0x0000000000DEF000-memory.dll
Size

572KB
MD5

6e2ff6488f39f9b17980af38d7179a8b
SHA1

6826e93503ea185cadc79cf35963b8b02dd9d863
SHA256

03b6f8437c5c2001f1d6ff033d25a73adc37c9ba778e7706b02b181ccab1d5c3
SHA512

892c2c3865acebb424396f3292f74cf72cf92f7997cb1840a23bff9e6e9b3a06e86b2437099c5f6f901d419de334f7499f329f6d8ff6c8ad6815a80ff6dd669b

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1232 1392 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1412 wrote to memory of 1392	1412	rundll32.exe	rundll32.exe
PID 1412 wrote to memory of 1392	1412	rundll32.exe	rundll32.exe
PID 1412 wrote to memory of 1392	1412	rundll32.exe	rundll32.exe
PID 1412 wrote to memory of 1392	1412	rundll32.exe	rundll32.exe
PID 1412 wrote to memory of 1392	1412	rundll32.exe	rundll32.exe
PID 1412 wrote to memory of 1392	1412	rundll32.exe	rundll32.exe
PID 1412 wrote to memory of 1392	1412	rundll32.exe	rundll32.exe
PID 1392 wrote to memory of 1232	1392	rundll32.exe	WerFault.exe
PID 1392 wrote to memory of 1232	1392	rundll32.exe	WerFault.exe
PID 1392 wrote to memory of 1232	1392	rundll32.exe	WerFault.exe
PID 1392 wrote to memory of 1232	1392	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1340-58-0x0000000000D60000-0x0000000000DEF000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1340-58-0x0000000000D60000-0x0000000000DEF000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 196
3⤵
- Program crash
PID:1232

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1232-56-0x0000000000000000-mapping.dmp

Download
memory/1392-54-0x0000000000000000-mapping.dmp

Download
memory/1392-55-0x0000000075901000-0x0000000075903000-memory.dmp

Filesize
8KB

Download