Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-06-2022 11:35
Static task
static1
Behavioral task
behavioral1
Sample
y5CAB.tmp.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
y5CAB.tmp.dll
-
Size
559KB
-
MD5
6eefce6e0b2c458abf2665663cb73c2b
-
SHA1
563b082e19594876e8b84f22cb49b0fc4eb66a25
-
SHA256
39c955c9e906075c11948edd79ffc6d6fcc5b5e3ac336231f52c3b03e718371e
-
SHA512
44fe4de02f3b21a62e3e0f3f4b49f071028e28d9748caa137c9f9ac3fbb7f59b6daa18592a661471dedc3f78c5fc451e9f503cf1a847b578b695e106f5cb4dfe
Malware Config
Signatures
-
Detects SVCReady loader 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1988-131-0x0000000010000000-0x0000000010091000-memory.dmp family_svcready behavioral2/memory/1988-132-0x0000000010000000-0x0000000010091000-memory.dmp family_svcready -
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target Process procid_target 4084 1988 WerFault.exe 80 5072 1988 WerFault.exe 80 1344 1988 WerFault.exe 80 3032 1988 WerFault.exe 80 4636 1988 WerFault.exe 80 2564 1988 WerFault.exe 80 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid Process procid_target PID 2096 wrote to memory of 1988 2096 rundll32.exe 80 PID 2096 wrote to memory of 1988 2096 rundll32.exe 80 PID 2096 wrote to memory of 1988 2096 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\y5CAB.tmp.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\y5CAB.tmp.dll,#12⤵PID:1988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 5443⤵
- Program crash
PID:4084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 5803⤵
- Program crash
PID:5072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 6843⤵
- Program crash
PID:1344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 7883⤵
- Program crash
PID:3032
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 7963⤵
- Program crash
PID:4636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 7723⤵
- Program crash
PID:2564
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1988 -ip 19881⤵PID:2232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1988 -ip 19881⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1988 -ip 19881⤵PID:3424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1988 -ip 19881⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1988 -ip 19881⤵PID:2716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1988 -ip 19881⤵PID:3468