54e531ea3cd86f5bc904a0ab391104a952a463eb3c8c7cd8d7a6527d0db767c2 | Triage

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-07-2022 18:33

Sharing

Report Analysis Logs

General

Target

1324-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

fdc1d330245a03bfa877bb3956171da7
SHA1

b3ea962e9e5af6fe09af911250f68536733cfacc
SHA256

54e531ea3cd86f5bc904a0ab391104a952a463eb3c8c7cd8d7a6527d0db767c2
SHA512

51dc3fb5d7a7ed9080b20f5ecf082e2c8f59c9c8866d4cc450b7a55f1b9f3e83bf23d435422115904962f398641fcef81fed0a1b8d2ad7522609f9f33020403a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1208 2004 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2004 wrote to memory of 1208	2004	rundll32.exe	WerFault.exe
PID 2004 wrote to memory of 1208	2004	rundll32.exe	WerFault.exe
PID 2004 wrote to memory of 1208	2004	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1324-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2004 -s 56
2⤵
- Program crash
PID:1208

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-54-0x0000000000000000-mapping.dmp

Download