48e7e1700010c25662ae7324d7798570e95d7227ef74a4fadf7b7d6e695b5a96 | Triage

Analysis

max time kernel
114s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-05-2022 15:18

Sharing

Report Analysis Logs

General

Target

TO PC/_ctypes.dll
Size

124KB
MD5

6fe3827e6704443e588c2701568b5f89
SHA1

ac9325fd29dead82ccd30be3ee7ee91c3aaeb967
SHA256

73acf2e0e28040cd696255abd53caaa811470b17a07c7b4d5a94f346b7474391
SHA512

be2502c006a615df30e61bea138bd1afca30640f39522d18db94df293c71df0a86c88df5fd5d8407daf1ccea6fac012d086212a3b80b8c32ede33b937881533a

Score

3^/10

Malware Config

Signatures

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

220 2020 WerFault.exe rundll32.exe
4928 2020 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2020 wrote to memory of 220	2020	rundll32.exe	WerFault.exe
PID 2020 wrote to memory of 220	2020	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\TO PC\_ctypes.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2020 -s 368
2⤵
- Program crash
PID:220

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2020 -s 368
2⤵
- Program crash
PID:4928

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 2020 -ip 2020
1⤵
PID:800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-130-0x0000000000000000-mapping.dmp

Download