b15903d4708f2d95d0dd710d7b66d25c15aeab266a0cea0e306a0203141008c6 | Triage™

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
08/07/2022, 10:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2040-54-0x0000000180000000-0x0000000180009000-memory.dll
Size 36KB
Sample220708-m3vsxabhbr
SHA256 b15903d4708f2d95d0dd710d7b66d25c15aeab266a0cea0e306a0203141008c6
MD5 aed2da9047bfef63ad955d2439348062
SHA1 c5525606917ac2fe1dd44b8223486cb0ba07f078
SHA512 0c8c9e64c6a0430118a4277895635c6c582b7d8f3ce8c6aa584b41c361adb1dd40f76117a76679d30c5febbac9ca23fdbef1b1b742af9b994d9ff491602fea2a
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
676	1968	WerFault.exe	14

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 676	1968	rundll32.exe	28
PID 1968 wrote to memory of 676	1968	rundll32.exe	28
PID 1968 wrote to memory of 676	1968	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2040-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1968 -s 56
  2⤵
  - Program crash
  PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads