598d3289405846f66a5a42d2b6d9c314496a615385b46a2817b77030f2a9cc55 | Triage

Analysis

max time kernel
27s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
15-04-2022 17:28

Sharing

Report Analysis Logs

General

Target

516-70-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

f9f00ec1b1304529392bfcd5f3912d57
SHA1

97cd688f685cea4c28ba545bef27da15ba6ae934
SHA256

598d3289405846f66a5a42d2b6d9c314496a615385b46a2817b77030f2a9cc55
SHA512

8c89cc6684424aedbfc59a0cf3936987249998d881034ad1fc081a97f52d08e1893d317ee51c7af4cc5b6f57bcaa8fe888f63cc3b5c19bf184bb1aff809097bb

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

620 1360 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1360 wrote to memory of 620	1360	rundll32.exe	WerFault.exe
PID 1360 wrote to memory of 620	1360	rundll32.exe	WerFault.exe
PID 1360 wrote to memory of 620	1360	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\516-70-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1360 -s 56
2⤵
- Program crash
PID:620

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-54-0x0000000000000000-mapping.dmp

Download