d7a6dd6957f075c8274bbdbd4a51da8c2d199b52d47586d201cf0e242b268284 | Triage

Analysis

max time kernel
43s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
26-04-2022 13:45

Sharing

Report Analysis Logs

General

Target

1152-57-0x0000000010000000-0x000000001008F000-memory.dll
Size

572KB
MD5

5f7a27362843e108e01c1ab9c369e47c
SHA1

598cd75d8dc5cfa94cea6502eb0fb2dd50716fdb
SHA256

d7a6dd6957f075c8274bbdbd4a51da8c2d199b52d47586d201cf0e242b268284
SHA512

96ff8304310a20048d57c1b83aa76dad5256c8e1398b69d67f2cfcf93019f811b1b506026ccb9313c5f0f426e1e0d3213d89e32d5adb1dded029c85689fd8b85

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1680 1596 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1528 wrote to memory of 1596	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1596	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1596	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1596	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1596	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1596	1528	rundll32.exe	rundll32.exe
PID 1528 wrote to memory of 1596	1528	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1680	1596	rundll32.exe	WerFault.exe
PID 1596 wrote to memory of 1680	1596	rundll32.exe	WerFault.exe
PID 1596 wrote to memory of 1680	1596	rundll32.exe	WerFault.exe
PID 1596 wrote to memory of 1680	1596	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1152-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1152-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 196
3⤵
- Program crash
PID:1680

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1596-54-0x0000000000000000-mapping.dmp

Download
memory/1596-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1680-56-0x0000000000000000-mapping.dmp

Download