b6a751552fe07e2a0274735eeb7d448083b94d7f4b9560c29bae925051049af7 | Triage

Analysis

max time kernel
137s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28-05-2022 03:05

Sharing

Report Analysis Logs

General

Target

b6a751552fe07e2a0274735eeb7d448083b94d7f4b9560c29bae925051049af7.dll
Size

203KB
MD5

02b77a3634d7f5ed8a55c3cb29aabad7
SHA1

ad24c5866408ddb97fd06be909075ce08ef7a1bb
SHA256

b6a751552fe07e2a0274735eeb7d448083b94d7f4b9560c29bae925051049af7
SHA512

3d1bc905cc31dce803bac878b73d7608b696afc89ba28d083f687f8a00f49cb8207cc6acd026389cac55c3ea8889221fcd6325c9e1ab649751414ec7c946ddf2

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2808 1416 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5016 wrote to memory of 1416	5016	rundll32.exe	rundll32.exe
PID 5016 wrote to memory of 1416	5016	rundll32.exe	rundll32.exe
PID 5016 wrote to memory of 1416	5016	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6a751552fe07e2a0274735eeb7d448083b94d7f4b9560c29bae925051049af7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5016

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6a751552fe07e2a0274735eeb7d448083b94d7f4b9560c29bae925051049af7.dll,#1
2⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 632
3⤵
- Program crash
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1416 -ip 1416
1⤵
PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-130-0x0000000000000000-mapping.dmp

Download