5527a78be4953bb3cfccfe8374c9644768f782ce69866a261d58f79b7f94513b | Triage

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
26-04-2022 13:29

Sharing

Report Analysis Logs

General

Target

1704-57-0x0000000010000000-0x000000001008F000-memory.dll
Size

572KB
MD5

c470a5dacabe9f04f48441e48cf83ba9
SHA1

414ffd13f416d770daa862235304bb00d92697b6
SHA256

5527a78be4953bb3cfccfe8374c9644768f782ce69866a261d58f79b7f94513b
SHA512

944cf000824a01fd3420414948075bef1aa22cec386c693adcb4a0cf4365cbc2e13ab56f466523ecb181fb080b5c47e347e28a282aee1a23ba7ed7b907a612a5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

644 1644 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1472 wrote to memory of 1644	1472	rundll32.exe	rundll32.exe
PID 1472 wrote to memory of 1644	1472	rundll32.exe	rundll32.exe
PID 1472 wrote to memory of 1644	1472	rundll32.exe	rundll32.exe
PID 1472 wrote to memory of 1644	1472	rundll32.exe	rundll32.exe
PID 1472 wrote to memory of 1644	1472	rundll32.exe	rundll32.exe
PID 1472 wrote to memory of 1644	1472	rundll32.exe	rundll32.exe
PID 1472 wrote to memory of 1644	1472	rundll32.exe	rundll32.exe
PID 1644 wrote to memory of 644	1644	rundll32.exe	WerFault.exe
PID 1644 wrote to memory of 644	1644	rundll32.exe	WerFault.exe
PID 1644 wrote to memory of 644	1644	rundll32.exe	WerFault.exe
PID 1644 wrote to memory of 644	1644	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 196
3⤵
- Program crash
PID:644

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-56-0x0000000000000000-mapping.dmp

Download
memory/1644-54-0x0000000000000000-mapping.dmp

Download
memory/1644-55-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download