c53ef46e891acab21127cab4c2479d87ab52f232630e26af3bbcaa616c7fa491 | Triage

Analysis

max time kernel
0s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-04-2022 12:04

Sharing

Report Analysis Logs

General

Target

HT.dll
Size

145KB
MD5

7c2ab92d6beabb21e040ecbf00b14eeb
SHA1

00c7e9faba283deaae743c962eacc3d177f7d1a4
SHA256

c53ef46e891acab21127cab4c2479d87ab52f232630e26af3bbcaa616c7fa491
SHA512

165414cbb47921f2ef1039a5a9e94fee4fc84f296ffc9d8de66c52f8b4e7d9449797249253b42844d1c671d99a56b1b518ffcebe5966e049d7f74d4407cb9bb9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

860 1792 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1796 wrote to memory of 1792	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1792	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1792	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1792	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1792	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1792	1796	rundll32.exe	rundll32.exe
PID 1796 wrote to memory of 1792	1796	rundll32.exe	rundll32.exe
PID 1792 wrote to memory of 860	1792	rundll32.exe	WerFault.exe
PID 1792 wrote to memory of 860	1792	rundll32.exe	WerFault.exe
PID 1792 wrote to memory of 860	1792	rundll32.exe	WerFault.exe
PID 1792 wrote to memory of 860	1792	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HT.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\HT.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 224
3⤵
- Program crash
PID:860

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-56-0x0000000000000000-mapping.dmp

Download
memory/1792-54-0x0000000000000000-mapping.dmp

Download
memory/1792-55-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download