Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14/06/2022, 08:44
Behavioral task
behavioral1
Sample
1100-57-0x0000000000170000-0x00000000001DF000-memory.dll
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1100-57-0x0000000000170000-0x00000000001DF000-memory.dll
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
1100-57-0x0000000000170000-0x00000000001DF000-memory.dll
-
Size
444KB
-
MD5
7de591e789330b7e552afc08dfa10db6
-
SHA1
c633f35133aaaabf33e3715f6c96c2009775f328
-
SHA256
c0c459564513d0d1885e1d9a9ec3b452b805c95b81a91b2fd1b51176c0f49f58
-
SHA512
fbcb92d37c865a9726e7d0e208c567dc38566ab2260f8d89e31c8cf6c8305b8b9f23af9d6de982f38e09274ef142855023af8295400d437db9082d1ab575f3cf
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4664 2236 WerFault.exe 78 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1360 wrote to memory of 2236 1360 rundll32.exe 78 PID 1360 wrote to memory of 2236 1360 rundll32.exe 78 PID 1360 wrote to memory of 2236 1360 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1100-57-0x0000000000170000-0x00000000001DF000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1100-57-0x0000000000170000-0x00000000001DF000-memory.dll,#12⤵PID:2236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 5603⤵
- Program crash
PID:4664
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2236 -ip 22361⤵PID:3392