7d579250ce29e8cc2a68fa8e2515696902b3bc6262551839fc5601c735bd0da0 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 08:39

Sharing

Report Analysis Logs

General

Target

7d579250ce29e8cc2a68fa8e2515696902b3bc6262551839fc5601c735bd0da0.dll
Size

204KB
MD5

1800d18d1f1644f8b358b15b9712d489
SHA1

7badad578c963ed281468cb00525b672197c6c60
SHA256

7d579250ce29e8cc2a68fa8e2515696902b3bc6262551839fc5601c735bd0da0
SHA512

6c8bc02d0b0a5aea55069a683a285f635e2e86cc593b5346fcd69b899ff6dc66747dfdfb2bf4d6d7b016802de7e15e84f8186bf9c51a9e3ce1d466ef2645dff1

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1508 1780 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 828 wrote to memory of 1780	828	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 1780	828	rundll32.exe	rundll32.exe
PID 828 wrote to memory of 1780	828	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d579250ce29e8cc2a68fa8e2515696902b3bc6262551839fc5601c735bd0da0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7d579250ce29e8cc2a68fa8e2515696902b3bc6262551839fc5601c735bd0da0.dll,#1
2⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 632
3⤵
- Program crash
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1780 -ip 1780
1⤵
PID:3080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1780-130-0x0000000000000000-mapping.dmp

Download