339ac3f27ca8dea8e2609f3140869c0ed5c5e55032536f2745acb3926c6b9336 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-07-2022 21:09

Sharing

Report Analysis Logs

General

Target

1328-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

3e18d8881c5b95240b7971000178d3c5
SHA1

aeec2f49f66456bc361b34c15eec030017b04b1a
SHA256

339ac3f27ca8dea8e2609f3140869c0ed5c5e55032536f2745acb3926c6b9336
SHA512

d1e3dc8481942e618995164bebd61423ff20a5767c814c83547c6478c595296ff7acea9448f42688860933639d6c69d0de61309f7c2548d3c812c8f2612bac59

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

908 1960 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1960 wrote to memory of 908	1960	rundll32.exe	WerFault.exe
PID 1960 wrote to memory of 908	1960	rundll32.exe	WerFault.exe
PID 1960 wrote to memory of 908	1960	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1328-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1960 -s 56
2⤵
- Program crash
PID:908

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-54-0x0000000000000000-mapping.dmp

Download