8324c4eb3b44c1d75d61f9b72e4b84881adf863441ff4d49985b8c9ab6417aaf | Triage

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
16/06/2022, 16:14

Sharing

Report Analysis Logs

General

Target

1124-90-0x0000000002570000-0x0000000002687000-memory.dll
Size

1.1MB
MD5

9b86f89877aff6ef3dcf4e69b9c69ad2
SHA1

db86aad6944ef87ca5f23a913f556c52467c8ad4
SHA256

8324c4eb3b44c1d75d61f9b72e4b84881adf863441ff4d49985b8c9ab6417aaf
SHA512

a4c3446fa889ee906c15990bc3b1f855aad35d70981078653f0e772aa14c01863100362ba9e06cb5f65d5037b76150b74e7b00d6bafc1b733dcecb76aeab25d9

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
676	1968	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 676	1968	rundll32.exe	28
PID 1968 wrote to memory of 676	1968	rundll32.exe	28
PID 1968 wrote to memory of 676	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1124-90-0x0000000002570000-0x0000000002687000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1968 -s 56
  2⤵
  - Program crash
  PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads