78a47b07ff39edbfbc4a4c6efb342d1705adecfe620d54314fa991a6085fb02e | Triage

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 08:39

Sharing

Report Analysis Logs

General

Target

78a47b07ff39edbfbc4a4c6efb342d1705adecfe620d54314fa991a6085fb02e.dll
Size

204KB
MD5

331cfae5eb299d14801f86bf64024ec7
SHA1

072d23ef8b23d9348fc53114eca35777df302320
SHA256

78a47b07ff39edbfbc4a4c6efb342d1705adecfe620d54314fa991a6085fb02e
SHA512

88b1bf2dfd768bc93e3630dd52a32fa2291ce61e6289dd96230c1e65f0da0e248461bbd6f384827affa42d16cd8cac22e4b9060bfd4a7762d6a10d403291d356

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1336 112 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2024 wrote to memory of 112	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 112	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 112	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 112	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 112	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 112	2024	rundll32.exe	rundll32.exe
PID 2024 wrote to memory of 112	2024	rundll32.exe	rundll32.exe
PID 112 wrote to memory of 1336	112	rundll32.exe	WerFault.exe
PID 112 wrote to memory of 1336	112	rundll32.exe	WerFault.exe
PID 112 wrote to memory of 1336	112	rundll32.exe	WerFault.exe
PID 112 wrote to memory of 1336	112	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78a47b07ff39edbfbc4a4c6efb342d1705adecfe620d54314fa991a6085fb02e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78a47b07ff39edbfbc4a4c6efb342d1705adecfe620d54314fa991a6085fb02e.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 232
3⤵
- Program crash
PID:1336

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-54-0x0000000000000000-mapping.dmp

Download
memory/112-55-0x0000000076011000-0x0000000076013000-memory.dmp

Filesize
8KB

Download
memory/1336-56-0x0000000000000000-mapping.dmp

Download