40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3 | Triage

Resubmissions

14-07-2022 15:44

220714-s6mvcscbe7 10

06-07-2022 11:56

220706-n4a1kacdhn 3

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
06-07-2022 11:56

Sharing

Report Analysis Logs

General

Target

40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3.dll
Size

183KB
MD5

4ee3fb2aba3b82171e6409e253bdddb5
SHA1

f5112f83885f2ede5d648224f18d78c5e70b9493
SHA256

40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3
SHA512

9a1c134c906eb85b6802edba37074cae7b5057d15f368937c075920b001ed1491004c1b021ba0bdf8e01d13398d96ae68f5b9968d4a7bc2614d9b83a758ac6e4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	2040	WerFault.exe	25

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1956	2040	rundll32.exe	27
PID 2040 wrote to memory of 1956	2040	rundll32.exe	27
PID 2040 wrote to memory of 1956	2040	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2040 -s 84
  2⤵
  - Program crash
  PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads