Analysis
-
max time kernel
38s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14/06/2022, 08:44
Behavioral task
behavioral1
Sample
1100-57-0x0000000000170000-0x00000000001DF000-memory.dll
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1100-57-0x0000000000170000-0x00000000001DF000-memory.dll
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
1100-57-0x0000000000170000-0x00000000001DF000-memory.dll
-
Size
444KB
-
MD5
7de591e789330b7e552afc08dfa10db6
-
SHA1
c633f35133aaaabf33e3715f6c96c2009775f328
-
SHA256
c0c459564513d0d1885e1d9a9ec3b452b805c95b81a91b2fd1b51176c0f49f58
-
SHA512
fbcb92d37c865a9726e7d0e208c567dc38566ab2260f8d89e31c8cf6c8305b8b9f23af9d6de982f38e09274ef142855023af8295400d437db9082d1ab575f3cf
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 848 2032 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 840 wrote to memory of 2032 840 rundll32.exe 27 PID 840 wrote to memory of 2032 840 rundll32.exe 27 PID 840 wrote to memory of 2032 840 rundll32.exe 27 PID 840 wrote to memory of 2032 840 rundll32.exe 27 PID 840 wrote to memory of 2032 840 rundll32.exe 27 PID 840 wrote to memory of 2032 840 rundll32.exe 27 PID 840 wrote to memory of 2032 840 rundll32.exe 27 PID 2032 wrote to memory of 848 2032 rundll32.exe 28 PID 2032 wrote to memory of 848 2032 rundll32.exe 28 PID 2032 wrote to memory of 848 2032 rundll32.exe 28 PID 2032 wrote to memory of 848 2032 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1100-57-0x0000000000170000-0x00000000001DF000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1100-57-0x0000000000170000-0x00000000001DF000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1963⤵
- Program crash
PID:848
-
-