b9439b92bf5033352a263bbed07ef03ee4669ae651a08076808f9ba90fe54357 | Triage

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-06-2022 01:17

Sharing

Report Analysis Logs

General

Target

b9439b92bf5033352a263bbed07ef03ee4669ae651a08076808f9ba90fe54357.dll
Size

203KB
MD5

2389558f5f4a7593b7f9eb68e03db034
SHA1

88ddf573652d2e53a82a8de8bdd5acc0c6cac8fd
SHA256

b9439b92bf5033352a263bbed07ef03ee4669ae651a08076808f9ba90fe54357
SHA512

862f1b40f08346f098743a38fd520abf9c87fba37356ff234c40b2cd3637c5b6bd505f6ed983a5145ed3c5af1b0d0fe8d39613861c14c4f741f159c8a0a8e214

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

592 1608 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1276 wrote to memory of 1608	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1608	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1608	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1608	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1608	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1608	1276	rundll32.exe	rundll32.exe
PID 1276 wrote to memory of 1608	1276	rundll32.exe	rundll32.exe
PID 1608 wrote to memory of 592	1608	rundll32.exe	WerFault.exe
PID 1608 wrote to memory of 592	1608	rundll32.exe	WerFault.exe
PID 1608 wrote to memory of 592	1608	rundll32.exe	WerFault.exe
PID 1608 wrote to memory of 592	1608	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9439b92bf5033352a263bbed07ef03ee4669ae651a08076808f9ba90fe54357.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9439b92bf5033352a263bbed07ef03ee4669ae651a08076808f9ba90fe54357.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 232
3⤵
- Program crash
PID:592

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-56-0x0000000000000000-mapping.dmp

Download
memory/1608-54-0x0000000000000000-mapping.dmp

Download
memory/1608-55-0x0000000076C01000-0x0000000076C03000-memory.dmp

Filesize
8KB

Download