b6a751552fe07e2a0274735eeb7d448083b94d7f4b9560c29bae925051049af7 | Triage

Analysis

max time kernel
22s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
28-05-2022 03:05

Sharing

Report Analysis Logs

General

Target

b6a751552fe07e2a0274735eeb7d448083b94d7f4b9560c29bae925051049af7.dll
Size

203KB
MD5

02b77a3634d7f5ed8a55c3cb29aabad7
SHA1

ad24c5866408ddb97fd06be909075ce08ef7a1bb
SHA256

b6a751552fe07e2a0274735eeb7d448083b94d7f4b9560c29bae925051049af7
SHA512

3d1bc905cc31dce803bac878b73d7608b696afc89ba28d083f687f8a00f49cb8207cc6acd026389cac55c3ea8889221fcd6325c9e1ab649751414ec7c946ddf2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1120 1992 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1116 wrote to memory of 1992	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1992	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1992	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1992	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1992	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1992	1116	rundll32.exe	rundll32.exe
PID 1116 wrote to memory of 1992	1116	rundll32.exe	rundll32.exe
PID 1992 wrote to memory of 1120	1992	rundll32.exe	WerFault.exe
PID 1992 wrote to memory of 1120	1992	rundll32.exe	WerFault.exe
PID 1992 wrote to memory of 1120	1992	rundll32.exe	WerFault.exe
PID 1992 wrote to memory of 1120	1992	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6a751552fe07e2a0274735eeb7d448083b94d7f4b9560c29bae925051049af7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6a751552fe07e2a0274735eeb7d448083b94d7f4b9560c29bae925051049af7.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 232
3⤵
- Program crash
PID:1120

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-56-0x0000000000000000-mapping.dmp

Download
memory/1992-54-0x0000000000000000-mapping.dmp

Download
memory/1992-55-0x00000000755C1000-0x00000000755C3000-memory.dmp

Filesize
8KB

Download