34f548fdc1732103e6dae977ea43ada79e36c7d472292db82d974ae51084bba2 | Triage

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-06-2022 19:32

Sharing

Report Analysis Logs

General

Target

732-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

cc7ed5e24ab337ffa3cf8e1078739e2f
SHA1

01c1042e5ca791972c4124cd9712d1177a8a4b3d
SHA256

34f548fdc1732103e6dae977ea43ada79e36c7d472292db82d974ae51084bba2
SHA512

88b31e613a4ea55fd957074b0edbb625c82eb14605c18a05dc20204e54184421ed03a748e1cd651c20f18d83dbc1e1d04e8504a62e98ad7aff516b46109ac689

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1256 452 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 452 wrote to memory of 1256	452	rundll32.exe	WerFault.exe
PID 452 wrote to memory of 1256	452	rundll32.exe	WerFault.exe
PID 452 wrote to memory of 1256	452	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\732-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:452

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 452 -s 56
2⤵
- Program crash
PID:1256

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-54-0x0000000000000000-mapping.dmp

Download