690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87 | Triage

Resubmissions

26-04-2022 23:42

220426-3p7hjsegd6 3

27-07-2021 22:11

210727-3b1tcqmnps 3

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
26-04-2022 23:42

Sharing

Report Analysis Logs

General

Target

690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87.dll
Size

34KB
MD5

1ca0fbd832f9f7cdc0e50b29bd0d970f
SHA1

9be6a2bc9df78f4566e5690e2f1bb696ae96cb48
SHA256

690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87
SHA512

5b236385ac4c1a6131163c6cb562f4c87691990a84b08afa7fbe764b5ddf3bc88edd7efe16dd6bd7ba5b6c7c9271146100a41ed9289c73958e7b282eaa7740e1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

940 1452 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2008 wrote to memory of 1452	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1452	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1452	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1452	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1452	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1452	2008	rundll32.exe	rundll32.exe
PID 2008 wrote to memory of 1452	2008	rundll32.exe	rundll32.exe
PID 1452 wrote to memory of 940	1452	rundll32.exe	WerFault.exe
PID 1452 wrote to memory of 940	1452	rundll32.exe	WerFault.exe
PID 1452 wrote to memory of 940	1452	rundll32.exe	WerFault.exe
PID 1452 wrote to memory of 940	1452	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 224
3⤵
- Program crash
PID:940

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-56-0x0000000000000000-mapping.dmp

Download
memory/1452-54-0x0000000000000000-mapping.dmp

Download
memory/1452-55-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download