Analysis
-
max time kernel
28s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-06-2022 04:11
Behavioral task
behavioral1
Sample
305f2634325220221d799665a2386f67236f6602158b0ff4957b6a8c5a90f4bd.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
305f2634325220221d799665a2386f67236f6602158b0ff4957b6a8c5a90f4bd.dll
-
Size
186KB
-
MD5
6fcf9b1fea714dfc586bbe8bf638c2a4
-
SHA1
5307be00240a539c135116931f1a003124dd13ab
-
SHA256
305f2634325220221d799665a2386f67236f6602158b0ff4957b6a8c5a90f4bd
-
SHA512
468d0069c4fdf2759043663443453eb590355d99dd58a16041fd0095ff8cfd0bfea9ad52aaed89e621753de751e046141e125571b8180bdfc68f01cc6495ad98
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 896 1472 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1912 wrote to memory of 1472 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1472 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1472 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1472 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1472 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1472 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 1472 1912 rundll32.exe rundll32.exe PID 1472 wrote to memory of 896 1472 rundll32.exe WerFault.exe PID 1472 wrote to memory of 896 1472 rundll32.exe WerFault.exe PID 1472 wrote to memory of 896 1472 rundll32.exe WerFault.exe PID 1472 wrote to memory of 896 1472 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\305f2634325220221d799665a2386f67236f6602158b0ff4957b6a8c5a90f4bd.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\305f2634325220221d799665a2386f67236f6602158b0ff4957b6a8c5a90f4bd.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 3443⤵
- Program crash