Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 05:02
Static task
static1
Behavioral task
behavioral1
Sample
c17325f4097a9a8fc2a190262222c61acae2274dc8f5a377128ddbf24f4d07aa.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c17325f4097a9a8fc2a190262222c61acae2274dc8f5a377128ddbf24f4d07aa.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
c17325f4097a9a8fc2a190262222c61acae2274dc8f5a377128ddbf24f4d07aa.dll
-
Size
199KB
-
MD5
8b39bbd8e55cd54357c35186250dc7c4
-
SHA1
f86db1a9d1407b2f02284617de1c745ce2a41a5f
-
SHA256
c17325f4097a9a8fc2a190262222c61acae2274dc8f5a377128ddbf24f4d07aa
-
SHA512
9c3325e6819828a838aaf7b3df6db753b0761ec70ca5a7fec9bddc6f5b3d9a80d420e52b4fab7cbe2faf1da83dfd899226ea122b1362364f841ce1992c144756
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2044 1952 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1984 wrote to memory of 1952 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1952 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1952 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1952 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1952 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1952 1984 rundll32.exe rundll32.exe PID 1984 wrote to memory of 1952 1984 rundll32.exe rundll32.exe PID 1952 wrote to memory of 2044 1952 rundll32.exe WerFault.exe PID 1952 wrote to memory of 2044 1952 rundll32.exe WerFault.exe PID 1952 wrote to memory of 2044 1952 rundll32.exe WerFault.exe PID 1952 wrote to memory of 2044 1952 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c17325f4097a9a8fc2a190262222c61acae2274dc8f5a377128ddbf24f4d07aa.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c17325f4097a9a8fc2a190262222c61acae2274dc8f5a377128ddbf24f4d07aa.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 2443⤵
- Program crash