Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
10/07/2022, 07:22
Static task
static1
Behavioral task
behavioral1
Sample
272-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
272-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
272-54-0x0000000180000000-0x0000000180009000-memory.dll
-
Size
36KB
-
MD5
b0f21007e0ff37526324819eec2fc78e
-
SHA1
25869ecbf8c736ee5b5857c54c17d8e56a7448a7
-
SHA256
13c6687fd22b4e99dbc5cc8e4aaeae103cfe431cdbaa5e6b53293075b515f348
-
SHA512
b8df7afd882bbd11f7f0e17cf4a08bed3ff7bf734b37504d8b8f567745af5900f10dffcb89490ca27dae5f80c824d48ce856b648b9434a93a9a14a586be0eb5e
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1936 1088 WerFault.exe 10 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1936 1088 rundll32.exe 27 PID 1088 wrote to memory of 1936 1088 rundll32.exe 27 PID 1088 wrote to memory of 1936 1088 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\272-54-0x0000000180000000-0x0000000180009000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1088 -s 562⤵
- Program crash
PID:1936
-