2f0ebaa4e5226800202840d739ef8cd5a2ae508421c50872e5f30f166bdef9c7 | Triage

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220414-en
submitted
07-07-2022 15:57

Sharing

Report Analysis Logs

General

Target

1272-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

2e4941a8d58925ab63922e559c1053cc
SHA1

46bc4118c1724329f569f985ccf49c88e5a1395b
SHA256

2f0ebaa4e5226800202840d739ef8cd5a2ae508421c50872e5f30f166bdef9c7
SHA512

280dbd46ad5fe4becade4bd29d3c9c49e7b3d0888a136fda2d3d4deabde206cd14bbfffa0a739658650267b72573c93b96fdec83028308362e057db267cfb1d3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1988 1660 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1660 wrote to memory of 1988	1660	rundll32.exe	WerFault.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	WerFault.exe
PID 1660 wrote to memory of 1988	1660	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1272-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1660 -s 56
2⤵
- Program crash
PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-54-0x0000000000000000-mapping.dmp

Download