d7a6dd6957f075c8274bbdbd4a51da8c2d199b52d47586d201cf0e242b268284 | Triage

Analysis

max time kernel
71s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26-04-2022 13:45

Sharing

Report Analysis Logs

General

Target

1152-57-0x0000000010000000-0x000000001008F000-memory.dll
Size

572KB
MD5

5f7a27362843e108e01c1ab9c369e47c
SHA1

598cd75d8dc5cfa94cea6502eb0fb2dd50716fdb
SHA256

d7a6dd6957f075c8274bbdbd4a51da8c2d199b52d47586d201cf0e242b268284
SHA512

96ff8304310a20048d57c1b83aa76dad5256c8e1398b69d67f2cfcf93019f811b1b506026ccb9313c5f0f426e1e0d3213d89e32d5adb1dded029c85689fd8b85

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1372 3644 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4688 wrote to memory of 3644	4688	rundll32.exe	rundll32.exe
PID 4688 wrote to memory of 3644	4688	rundll32.exe	rundll32.exe
PID 4688 wrote to memory of 3644	4688	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1152-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4688

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1152-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
2⤵
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 412
3⤵
- Program crash
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3644 -ip 3644
1⤵
PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-130-0x0000000000000000-mapping.dmp

Download