b9439b92bf5033352a263bbed07ef03ee4669ae651a08076808f9ba90fe54357 | Triage

Analysis

max time kernel
91s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-06-2022 01:17

Sharing

Report Analysis Logs

General

Target

b9439b92bf5033352a263bbed07ef03ee4669ae651a08076808f9ba90fe54357.dll
Size

203KB
MD5

2389558f5f4a7593b7f9eb68e03db034
SHA1

88ddf573652d2e53a82a8de8bdd5acc0c6cac8fd
SHA256

b9439b92bf5033352a263bbed07ef03ee4669ae651a08076808f9ba90fe54357
SHA512

862f1b40f08346f098743a38fd520abf9c87fba37356ff234c40b2cd3637c5b6bd505f6ed983a5145ed3c5af1b0d0fe8d39613861c14c4f741f159c8a0a8e214

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3132 1844 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2208 wrote to memory of 1844	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 1844	2208	rundll32.exe	rundll32.exe
PID 2208 wrote to memory of 1844	2208	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9439b92bf5033352a263bbed07ef03ee4669ae651a08076808f9ba90fe54357.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b9439b92bf5033352a263bbed07ef03ee4669ae651a08076808f9ba90fe54357.dll,#1
2⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 632
3⤵
- Program crash
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1844 -ip 1844
1⤵
PID:3176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1844-130-0x0000000000000000-mapping.dmp

Download