b8703766d69fa2d3c56452a62611237ae43c57460a58eb5b34d0a7cef2badd16 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-07-2022 21:10

Sharing

Report Analysis Logs

General

Target

1600-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

5f917cbcd6111c05f9b7f05ebe6214d7
SHA1

b818a7f0b67381efdeb773aab545a9212edabd74
SHA256

b8703766d69fa2d3c56452a62611237ae43c57460a58eb5b34d0a7cef2badd16
SHA512

f5348d687ef3ce6d34585da9a20f3b3867e123af94c14c449388a274f6e5b18d368574626b427caddf3b4d27d7eed76b31d5282da124b2f36beb0fa8ad843f8e

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1184 960 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 960 wrote to memory of 1184	960	rundll32.exe	WerFault.exe
PID 960 wrote to memory of 1184	960	rundll32.exe	WerFault.exe
PID 960 wrote to memory of 1184	960	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1600-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 960 -s 56
2⤵
- Program crash
PID:1184

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-54-0x0000000000000000-mapping.dmp

Download