203b33c0e898bb05b7c124dd161bb042db5d044dfb29b58789c90e43f10fdc96 | Triage

Analysis

max time kernel
76s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
26-04-2022 14:01

Sharing

Report Analysis Logs

General

Target

1524-57-0x0000000010000000-0x000000001008F000-memory.dll
Size

572KB
MD5

9d40775824198b8a533d46b8a4bcdf49
SHA1

6a2810909a08de3d891943db5e96bfd65a9c44ee
SHA256

203b33c0e898bb05b7c124dd161bb042db5d044dfb29b58789c90e43f10fdc96
SHA512

e3ca10a11915f320cd85f92e374baa227f82bf110748bcea2b2ee71a2d8a1ca9a1c5997cc41648391dfa2ec1ac030f824dba741f57181e0e603461171bc067ab

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4332 1420 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2036 wrote to memory of 1420	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1420	2036	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 1420	2036	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1524-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1524-57-0x0000000010000000-0x000000001008F000-memory.dll,#1
2⤵
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 564
3⤵
- Program crash
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1420 -ip 1420
1⤵
PID:3248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-130-0x0000000000000000-mapping.dmp

Download