500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686 | Triage™

Resubmissions

14/07/2022, 15:44

220714-s6vj7scbe910

06/07/2022, 11:56

220706-n4ct6aede93

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
06/07/2022, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686.dll
Size 163KB
Sample220706-n4ct6aede9
SHA256 500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686
MD5 5ffc31841eb3b77f41f0ace61becd8fd
SHA1 87aa3c10f8a291fe4eceeb18e01a2aa1856966f3
SHA512 442e7d7537833a5ecdff6e5e892671376ee8e56b120a8c5dda32520e5fe499d85b7204d56637f4fd6e74f4cdf9e0e19efd80fe6d6bc8e118a73e9fa61ea444f6
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1084	1008	WerFault.exe	18

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 1084	1008	rundll32.exe	28
PID 1008 wrote to memory of 1084	1008	rundll32.exe	28
PID 1008 wrote to memory of 1084	1008	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1008 -s 84
  2⤵
  - Program crash
  PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads