Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
09/07/2022, 05:21
Behavioral task
behavioral1
Sample
1000-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1000-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
1000-54-0x0000000180000000-0x0000000180009000-memory.dll
-
Size
36KB
-
MD5
4d2b7f46150a06bb0284db1feb12c5f8
-
SHA1
05d54875b6837553a841da1e82b1ef6a78cd0423
-
SHA256
e5030414e77d0ec0d2ccd3e12f6fc6b43c9548938fba9123d25610ad91d859a1
-
SHA512
850d8a478fbb62aee055a4e4d610b3d309652c3205f55abb6067a6ea60e95bcfa04ad7b5ebfa31825ba8447df4d93642db22d98d64475dc89511e87397ac0751
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 860 1364 WerFault.exe 20 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1364 wrote to memory of 860 1364 rundll32.exe 28 PID 1364 wrote to memory of 860 1364 rundll32.exe 28 PID 1364 wrote to memory of 860 1364 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1000-54-0x0000000180000000-0x0000000180009000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1364 -s 562⤵
- Program crash
PID:860
-