9c7feb98fb5804f1f80dd03db1f84a06b68ea6043d2d34ab53edce82b83827b2 | Triage

Analysis

max time kernel
91s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21-05-2022 14:57

Sharing

Report Analysis Logs

General

Target

Perl510.dll
Size

924KB
MD5

dbf8b9ab8ae650d5b452240c0e9c90df
SHA1

1215872c6f7306d6ba14133eb706483f04445885
SHA256

9c7feb98fb5804f1f80dd03db1f84a06b68ea6043d2d34ab53edce82b83827b2
SHA512

f9ab16d7946f4dfab4abbe368d6863dbaa1e0c49b6b051ff44eecdf0053ee0d1204272b08ffc925d76335874ca1099ebebc84ba80be3aa9c9bd5e5007a62d3a9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1500 3092 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4660 wrote to memory of 3092	4660	rundll32.exe	rundll32.exe
PID 4660 wrote to memory of 3092	4660	rundll32.exe	rundll32.exe
PID 4660 wrote to memory of 3092	4660	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Perl510.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Perl510.dll,#1
2⤵
PID:3092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 600
3⤵
- Program crash
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3092 -ip 3092
1⤵
PID:4804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3092-130-0x0000000000000000-mapping.dmp

Download
memory/3092-131-0x0000000077800000-0x00000000779A3000-memory.dmp

Filesize
1.6MB

Download
memory/3092-132-0x0000000077070000-0x0000000077285000-memory.dmp

Filesize
2.1MB

Download