fa7ca313d7c48da99b885f848ee5f12b184a5686db7a114aaf3ffb18c47c5392 | Triage

Analysis

max time kernel
40s
max time network
42s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-07-2022 21:55

Sharing

Report Analysis Logs

General

Target

1996-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

e704e63f2435d1f261b0bc54a1a36866
SHA1

fa07c5652f0e5aa606615f8ac5eaeb6595725d8f
SHA256

fa7ca313d7c48da99b885f848ee5f12b184a5686db7a114aaf3ffb18c47c5392
SHA512

5825e9046a079cf198286ee9e9915e3076c0dfeb635de699639fd3e9946e2287bbd9814eef5641385367e20edd5ff050452644bef210a76ffa1fd55fe921bebf

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

912 1056 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1056 wrote to memory of 912	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 912	1056	rundll32.exe	WerFault.exe
PID 1056 wrote to memory of 912	1056	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1996-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1056 -s 56
2⤵
- Program crash
PID:912

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-54-0x0000000000000000-mapping.dmp

Download