Analysis
-
max time kernel
90s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14/06/2022, 09:13
Behavioral task
behavioral1
Sample
1796-57-0x00000000001E0000-0x000000000024F000-memory.dll
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1796-57-0x00000000001E0000-0x000000000024F000-memory.dll
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
1796-57-0x00000000001E0000-0x000000000024F000-memory.dll
-
Size
444KB
-
MD5
61c266164965a67ed6b760611ffd2447
-
SHA1
38a3e10184a5ee175293f8df713fc01e7cafc777
-
SHA256
8ec0884d8586ebd34abda9cd8632e2190d107334b27bd861c965501880fcedce
-
SHA512
cec65d5f73eef5b913b44c59051cfb00499c8e036c399095e0be377c4157cc0faa3346da1d7d0bc392f85ba8a1b5838592383c798236ea9fb724174629b3eed6
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1268 4540 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2204 wrote to memory of 4540 2204 rundll32.exe 79 PID 2204 wrote to memory of 4540 2204 rundll32.exe 79 PID 2204 wrote to memory of 4540 2204 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001E0000-0x000000000024F000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1796-57-0x00000000001E0000-0x000000000024F000-memory.dll,#12⤵PID:4540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 5603⤵
- Program crash
PID:1268
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4540 -ip 45401⤵PID:2828