feb5d3b7b7d0c3b81c71334f8d412f5833f2fe93f620d8fab159944c27097548 | Triage

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220414-en
submitted
29-05-2022 16:41

Sharing

Report Analysis Logs

General

Target

1808-55-0x00000000003A0000-0x00000000003A9000-memory.dll
Size

36KB
MD5

d7702716250ebd4401f3943ed61ab7ef
SHA1

0a169be69e2eacc2343756a2fb9efeebfeadafda
SHA256

feb5d3b7b7d0c3b81c71334f8d412f5833f2fe93f620d8fab159944c27097548
SHA512

23c4bd61fbcb91b9b75735653d36da0006d182beb1567beb0bffe4d3e99519dfb6091b291036ef81e3e56e9ef817e1e1cb6bec0891d3d9953fc349c34f05a9d3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1996 1240 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1240 wrote to memory of 1996	1240	rundll32.exe	WerFault.exe
PID 1240 wrote to memory of 1996	1240	rundll32.exe	WerFault.exe
PID 1240 wrote to memory of 1996	1240	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1808-55-0x00000000003A0000-0x00000000003A9000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1240 -s 56
2⤵
- Program crash
PID:1996

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x0000000000000000-mapping.dmp

Download