Analysis
-
max time kernel
37s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
26-06-2022 02:57
Static task
static1
Behavioral task
behavioral1
Sample
77ffbc84bb53e754063a0466a9e9d84fd2fcc5948fd0abf50d235c821e532862.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
77ffbc84bb53e754063a0466a9e9d84fd2fcc5948fd0abf50d235c821e532862.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
77ffbc84bb53e754063a0466a9e9d84fd2fcc5948fd0abf50d235c821e532862.dll
-
Size
204KB
-
MD5
364ec84fa3ec7aa68b2098dd51dc1fa4
-
SHA1
ea94165d297f54a91b01ccd41f9de98b5909d12a
-
SHA256
77ffbc84bb53e754063a0466a9e9d84fd2fcc5948fd0abf50d235c821e532862
-
SHA512
e95525cd1d20481dfb51b772d40aa94abbe4716fad2e734ed1572e6121be611ea765a0aa5b6302e1a789f1a47ae50a39984c3e86e091ae87e755607cb4e9025c
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 952 272 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 776 wrote to memory of 272 776 rundll32.exe rundll32.exe PID 776 wrote to memory of 272 776 rundll32.exe rundll32.exe PID 776 wrote to memory of 272 776 rundll32.exe rundll32.exe PID 776 wrote to memory of 272 776 rundll32.exe rundll32.exe PID 776 wrote to memory of 272 776 rundll32.exe rundll32.exe PID 776 wrote to memory of 272 776 rundll32.exe rundll32.exe PID 776 wrote to memory of 272 776 rundll32.exe rundll32.exe PID 272 wrote to memory of 952 272 rundll32.exe WerFault.exe PID 272 wrote to memory of 952 272 rundll32.exe WerFault.exe PID 272 wrote to memory of 952 272 rundll32.exe WerFault.exe PID 272 wrote to memory of 952 272 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\77ffbc84bb53e754063a0466a9e9d84fd2fcc5948fd0abf50d235c821e532862.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\77ffbc84bb53e754063a0466a9e9d84fd2fcc5948fd0abf50d235c821e532862.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 272 -s 2323⤵
- Program crash