6ba3a5e55580eec1856d8eaedaa719b2a36f94cf3bae7902f97a9128983be85b | Triage

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
23-05-2022 17:09

Sharing

Report Analysis Logs

General

Target

852-55-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

be759f3659ea88b9d7f6e17da001f76e
SHA1

b307af5db4ac78332e1ca7064aca41a6eb24eae5
SHA256

6ba3a5e55580eec1856d8eaedaa719b2a36f94cf3bae7902f97a9128983be85b
SHA512

5138fd5338487274da917846746aa1c5960622864e240ddd0bec00b6e1c30df6f076814cec7599603c0b5cc4f5a62b2977f8461091509eda144190c22aa9253d

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1972 1936 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1936 wrote to memory of 1972	1936	rundll32.exe	WerFault.exe
PID 1936 wrote to memory of 1972	1936	rundll32.exe	WerFault.exe
PID 1936 wrote to memory of 1972	1936	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\852-55-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1936 -s 56
2⤵
- Program crash
PID:1972

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1972-54-0x0000000000000000-mapping.dmp

Download