dd0ed2698c1694dcbbbf081c974dced25763cf1fad12eedc74130443e49e9949 | Triage™

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
08/07/2022, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
560-54-0x0000000180000000-0x0000000180009000-memory.dll
Size 36KB
Sample220708-ry9hqaebak
SHA256 dd0ed2698c1694dcbbbf081c974dced25763cf1fad12eedc74130443e49e9949
MD5 98d1febe29e4790f35fcf7b61fadf6b1
SHA1 9abae8764b33008590f84c5e5402a85cad56b0e2
SHA512 922ed57cfa9bfe8d1d25ba57a5d61bd54beaa9533595c459d4d7157744ab0eb8ad013f5cb2bbfbe7cec278b04487698d0032dfb0b5b6add3947e9c6c91a8d6dc
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
952	560	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 952	560	rundll32.exe	27
PID 560 wrote to memory of 952	560	rundll32.exe	27
PID 560 wrote to memory of 952	560	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\560-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 560 -s 56
  2⤵
  - Program crash
  PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads