275f927f5cc809ebba57c6e766c550d2d27b1841708459a876c6f5a99201ecb6 | Triage

Analysis

max time kernel
91s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
16-06-2022 05:03

Sharing

Report Analysis Logs

General

Target

275f927f5cc809ebba57c6e766c550d2d27b1841708459a876c6f5a99201ecb6.dll
Size

31KB
MD5

7f0fdddf5905886532c8a652abed1b6c
SHA1

44ce68a4badff4b22054b499215f4c90a207f703
SHA256

275f927f5cc809ebba57c6e766c550d2d27b1841708459a876c6f5a99201ecb6
SHA512

799239ff1f630457ac3fdcddb1b07fa5b44d02bfb2067f94fc0b8bb934d5611640344701fc594d57db28734b20d713839026ab4e113663697313bfe2bda4cff4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3228 1960 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2684 wrote to memory of 1960	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 1960	2684	rundll32.exe	rundll32.exe
PID 2684 wrote to memory of 1960	2684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\275f927f5cc809ebba57c6e766c550d2d27b1841708459a876c6f5a99201ecb6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\275f927f5cc809ebba57c6e766c550d2d27b1841708459a876c6f5a99201ecb6.dll,#1
2⤵
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 624
3⤵
- Program crash
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1960 -ip 1960
1⤵
PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1960-130-0x0000000000000000-mapping.dmp

Download