ef06295d10c7cc5af113cb1d171ef46f7c4bf51daf05184cce0e72430128f1c1 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
23-05-2022 18:56

Sharing

Report Analysis Logs

General

Target

4124-130-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

aed7566fa966fec97d18aba9dab405d0
SHA1

e6412625ad3dd308f2fa38e6da1c91d3de920ff1
SHA256

ef06295d10c7cc5af113cb1d171ef46f7c4bf51daf05184cce0e72430128f1c1
SHA512

db3c1eefba91710def8ef3386faeb9e94401417983a00212a7f928f4244cb4e3207c703f612f2ede74fcaad0b796957cbd1b992edc01b93c0ec29607c07927de

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1468 1948 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1948 wrote to memory of 1468	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 1468	1948	rundll32.exe	WerFault.exe
PID 1948 wrote to memory of 1468	1948	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4124-130-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1948 -s 56
2⤵
- Program crash
PID:1468

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-54-0x0000000000000000-mapping.dmp

Download