78a47b07ff39edbfbc4a4c6efb342d1705adecfe620d54314fa991a6085fb02e | Triage

Analysis

max time kernel
106s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 08:39

Sharing

Report Analysis Logs

General

Target

78a47b07ff39edbfbc4a4c6efb342d1705adecfe620d54314fa991a6085fb02e.dll
Size

204KB
MD5

331cfae5eb299d14801f86bf64024ec7
SHA1

072d23ef8b23d9348fc53114eca35777df302320
SHA256

78a47b07ff39edbfbc4a4c6efb342d1705adecfe620d54314fa991a6085fb02e
SHA512

88b1bf2dfd768bc93e3630dd52a32fa2291ce61e6289dd96230c1e65f0da0e248461bbd6f384827affa42d16cd8cac22e4b9060bfd4a7762d6a10d403291d356

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

888 2928 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1580 wrote to memory of 2928	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 2928	1580	rundll32.exe	rundll32.exe
PID 1580 wrote to memory of 2928	1580	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78a47b07ff39edbfbc4a4c6efb342d1705adecfe620d54314fa991a6085fb02e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78a47b07ff39edbfbc4a4c6efb342d1705adecfe620d54314fa991a6085fb02e.dll,#1
2⤵
PID:2928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 632
3⤵
- Program crash
PID:888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2928 -ip 2928
1⤵
PID:3628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-130-0x0000000000000000-mapping.dmp

Download