5527a78be4953bb3cfccfe8374c9644768f782ce69866a261d58f79b7f94513b | Triage

Analysis

max time kernel
143s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26-04-2022 13:29

Sharing

Report Analysis Logs

General

Target

1704-57-0x0000000010000000-0x000000001008F000-memory.dll
Size

572KB
MD5

c470a5dacabe9f04f48441e48cf83ba9
SHA1

414ffd13f416d770daa862235304bb00d92697b6
SHA256

5527a78be4953bb3cfccfe8374c9644768f782ce69866a261d58f79b7f94513b
SHA512

944cf000824a01fd3420414948075bef1aa22cec386c693adcb4a0cf4365cbc2e13ab56f466523ecb181fb080b5c47e347e28a282aee1a23ba7ed7b907a612a5

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

664 2696 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2332 wrote to memory of 2696	2332	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 2696	2332	rundll32.exe	rundll32.exe
PID 2332 wrote to memory of 2696	2332	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1704-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
2⤵
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 564
3⤵
- Program crash
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2696 -ip 2696
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2696-130-0x0000000000000000-mapping.dmp

Download