Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08/07/2022, 16:40
Behavioral task
behavioral1
Sample
480-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
480-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
480-54-0x0000000180000000-0x0000000180009000-memory.dll
-
Size
36KB
-
MD5
22acca09251eb5f1a1bf4b900ed8b0e3
-
SHA1
818b056afbe757595a086fa96d2aa17d2cefafad
-
SHA256
27a9a10fd8a519c2267186d53ec651771ed0a4c377ff295ed1f98ed2f1e24199
-
SHA512
fa47d05d06d69370526383ea770a843baf2634b95f0e13c02d234b60140a30dc357dc6086accc2f6fb738a355772818173a2fe99ffac6b1af7e9852670497601
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1840 1992 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1840 1992 rundll32.exe 28 PID 1992 wrote to memory of 1840 1992 rundll32.exe 28 PID 1992 wrote to memory of 1840 1992 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\480-54-0x0000000180000000-0x0000000180009000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1992 -s 562⤵
- Program crash
PID:1840
-