c95bf997ca49d47fd96019ba9a6b3dd79afed60518d8d19fb3e03d9453aeb1bd | Triage

Analysis

max time kernel
45s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
06-07-2022 15:44

Sharing

Report Analysis Logs

General

Target

1520-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

4b7387ae48aa136dc7fb63ac712c5ee9
SHA1

5d04d7390f3041e3ef82629c7081ab38548c3a06
SHA256

c95bf997ca49d47fd96019ba9a6b3dd79afed60518d8d19fb3e03d9453aeb1bd
SHA512

91c68464ef1055a2e5ed254083bec20084895330fa5f092aad489638c3e7abfe8e740a1d7ccd5297694728f0451cc6cb276d27e491420410c8058e16769a80ea

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1668 1452 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1452 wrote to memory of 1668	1452	rundll32.exe	WerFault.exe
PID 1452 wrote to memory of 1668	1452	rundll32.exe	WerFault.exe
PID 1452 wrote to memory of 1668	1452	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1520-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1452 -s 56
2⤵
- Program crash
PID:1668

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-54-0x0000000000000000-mapping.dmp

Download