Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14/06/2022, 09:13
Behavioral task
behavioral1
Sample
1796-57-0x00000000001E0000-0x000000000024F000-memory.dll
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1796-57-0x00000000001E0000-0x000000000024F000-memory.dll
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
1796-57-0x00000000001E0000-0x000000000024F000-memory.dll
-
Size
444KB
-
MD5
61c266164965a67ed6b760611ffd2447
-
SHA1
38a3e10184a5ee175293f8df713fc01e7cafc777
-
SHA256
8ec0884d8586ebd34abda9cd8632e2190d107334b27bd861c965501880fcedce
-
SHA512
cec65d5f73eef5b913b44c59051cfb00499c8e036c399095e0be377c4157cc0faa3346da1d7d0bc392f85ba8a1b5838592383c798236ea9fb724174629b3eed6
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 964 776 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1852 wrote to memory of 776 1852 rundll32.exe 28 PID 1852 wrote to memory of 776 1852 rundll32.exe 28 PID 1852 wrote to memory of 776 1852 rundll32.exe 28 PID 1852 wrote to memory of 776 1852 rundll32.exe 28 PID 1852 wrote to memory of 776 1852 rundll32.exe 28 PID 1852 wrote to memory of 776 1852 rundll32.exe 28 PID 1852 wrote to memory of 776 1852 rundll32.exe 28 PID 776 wrote to memory of 964 776 rundll32.exe 29 PID 776 wrote to memory of 964 776 rundll32.exe 29 PID 776 wrote to memory of 964 776 rundll32.exe 29 PID 776 wrote to memory of 964 776 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001E0000-0x000000000024F000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001E0000-0x000000000024F000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 776 -s 1963⤵
- Program crash
PID:964
-
-