Analysis
-
max time kernel
40s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 06:09
Static task
static1
Behavioral task
behavioral1
Sample
b165990a4acb1458b71b5d3ce1e847de0bfed53302a1aaece0b832f7607ca4dc.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b165990a4acb1458b71b5d3ce1e847de0bfed53302a1aaece0b832f7607ca4dc.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
b165990a4acb1458b71b5d3ce1e847de0bfed53302a1aaece0b832f7607ca4dc.dll
-
Size
204KB
-
MD5
755b6a278eefefc4371000405681d12e
-
SHA1
89a0e734657a790412e3dd6905afe44fd1b4d72a
-
SHA256
b165990a4acb1458b71b5d3ce1e847de0bfed53302a1aaece0b832f7607ca4dc
-
SHA512
676cdaa8644c5108e2210d66803012c0ba04a82e9d0f66a23af9e65ab7d8639204a182e7f58366c6058ce1fe26b0e4c921d940240e678b8b27359e3fbea46a6f
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 296 2016 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1668 wrote to memory of 2016 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 2016 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 2016 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 2016 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 2016 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 2016 1668 rundll32.exe rundll32.exe PID 1668 wrote to memory of 2016 1668 rundll32.exe rundll32.exe PID 2016 wrote to memory of 296 2016 rundll32.exe WerFault.exe PID 2016 wrote to memory of 296 2016 rundll32.exe WerFault.exe PID 2016 wrote to memory of 296 2016 rundll32.exe WerFault.exe PID 2016 wrote to memory of 296 2016 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b165990a4acb1458b71b5d3ce1e847de0bfed53302a1aaece0b832f7607ca4dc.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b165990a4acb1458b71b5d3ce1e847de0bfed53302a1aaece0b832f7607ca4dc.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 2323⤵
- Program crash