4cf6f3e5a5d4aa5855df82d40963e46c2fe42876b692ff9f2e535c03cdcc4cd1 | Triage

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
06-07-2022 14:08

Sharing

Report Analysis Logs

General

Target

o7m2se.dll
Size

1.5MB
MD5

53e39a08c5136787aecaf107f9e0c259
SHA1

2a64185b5fa2a0e5c30974b4624c31e668f8fadd
SHA256

e2a4f0f0954cf69f16c7672f6415f80c78492602bb82dc5009b4efde81521d48
SHA512

642493d839fd9a147c6d02a907cc2b898ffb91c1415359f22f8b1698dce6daa82fa23a26f5d099b837f11185dedafaa12c96e1e9fc5eff9d86a8a6917fa9c638

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1624	784	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 1624	784	rundll32.exe	27
PID 784 wrote to memory of 1624	784	rundll32.exe	27
PID 784 wrote to memory of 1624	784	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\o7m2se.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 784 -s 84
  2⤵
  - Program crash
  PID:1624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads