0da1824c4445705dd5dc895756881669e3f2a057fbd2bbc26c539ce2cccb1cbf | Triage

Analysis

max time kernel
41s
max time network
43s
platform
windows7_x64
resource
win7-20220414-en
submitted
27-06-2022 18:32

Sharing

Report Analysis Logs

General

Target

872-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

0ce9b97c12b1b9cf763907554945ba4e
SHA1

9e2b34cc8bccd140be56b3abff1c044de84ced21
SHA256

0da1824c4445705dd5dc895756881669e3f2a057fbd2bbc26c539ce2cccb1cbf
SHA512

12facedfb7e76225d9151ebf207d097894a22ab0ff0024db80ca40f9d82725ce980a963f79d6a9c4880c6e12357a7a1e2d05f74a4f11edc8d08b6b05c67280c0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1188 1520 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1520 wrote to memory of 1188	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1188	1520	rundll32.exe	WerFault.exe
PID 1520 wrote to memory of 1188	1520	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\872-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1520 -s 56
2⤵
- Program crash
PID:1188

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-54-0x0000000000000000-mapping.dmp

Download