3ef56fb19994148a7a18c028e6f04685fcdaa8077755639b9c34edb4a548d8e6 | Triage

Analysis

max time kernel
139s
max time network
170s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-05-2022 15:56

Sharing

Report Analysis Logs

General

Target

3ef56fb19994148a7a18c028e6f04685fcdaa8077755639b9c34edb4a548d8e6.dll
Size

1.1MB
MD5

abb3a1591d419e3980c306b3603f768e
SHA1

bd8053fc82663c618b7f48ecb44aeda13b501438
SHA256

3ef56fb19994148a7a18c028e6f04685fcdaa8077755639b9c34edb4a548d8e6
SHA512

7a6f85fb350a6b62a296b5cbf405cbdc5a0fe3625d8fafc4f84eee1ba2d84827f63ca9bd65d1edffa7209e87f22468f028414dce2abcefc75ec37e1e983e126f

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 10 IoCs

Processes:

rundll32.exe

flow	pid	process
3	1792	rundll32.exe
4	1792	rundll32.exe
5	1792	rundll32.exe
6	1792	rundll32.exe
7	1792	rundll32.exe
8	1792	rundll32.exe
11	1792	rundll32.exe
12	1792	rundll32.exe
13	1792	rundll32.exe
14	1792	rundll32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

948 1792 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1868 wrote to memory of 1792	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1792	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1792	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1792	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1792	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1792	1868	rundll32.exe	rundll32.exe
PID 1868 wrote to memory of 1792	1868	rundll32.exe	rundll32.exe
PID 1792 wrote to memory of 948	1792	rundll32.exe	WerFault.exe
PID 1792 wrote to memory of 948	1792	rundll32.exe	WerFault.exe
PID 1792 wrote to memory of 948	1792	rundll32.exe	WerFault.exe
PID 1792 wrote to memory of 948	1792	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef56fb19994148a7a18c028e6f04685fcdaa8077755639b9c34edb4a548d8e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3ef56fb19994148a7a18c028e6f04685fcdaa8077755639b9c34edb4a548d8e6.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 432
3⤵
- Program crash
PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-56-0x0000000000000000-mapping.dmp

Download
memory/1792-54-0x0000000000000000-mapping.dmp

Download
memory/1792-55-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download