605e60232e61f543c74ae03f23d4c314d037ee408f639667338a26dfbb6c910f | Triage

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-07-2022 04:06

Sharing

Report Analysis Logs

General

Target

605e60232e61f543c74ae03f23d4c314d037ee408f639667338a26dfbb6c910f.dll
Size

203KB
MD5

482b406d7b790fe426b0ee7ab32d19aa
SHA1

6d4c6128789904524a06898affd19b119bf4e986
SHA256

605e60232e61f543c74ae03f23d4c314d037ee408f639667338a26dfbb6c910f
SHA512

7e51cfb5aa25fd83b6151f58e7df9ab87647d44bde08566cfd49e26fd82f3b72f52a3bf4b0fafbce3a972be5f4288eec046585c6ad39b113bf9f8e63bcc199f0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

992 1700 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1564 wrote to memory of 1700	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 1700	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 1700	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 1700	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 1700	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 1700	1564	rundll32.exe	rundll32.exe
PID 1564 wrote to memory of 1700	1564	rundll32.exe	rundll32.exe
PID 1700 wrote to memory of 992	1700	rundll32.exe	WerFault.exe
PID 1700 wrote to memory of 992	1700	rundll32.exe	WerFault.exe
PID 1700 wrote to memory of 992	1700	rundll32.exe	WerFault.exe
PID 1700 wrote to memory of 992	1700	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\605e60232e61f543c74ae03f23d4c314d037ee408f639667338a26dfbb6c910f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\605e60232e61f543c74ae03f23d4c314d037ee408f639667338a26dfbb6c910f.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 232
3⤵
- Program crash
PID:992

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-56-0x0000000000000000-mapping.dmp

Download
memory/1700-54-0x0000000000000000-mapping.dmp

Download
memory/1700-55-0x0000000075CD1000-0x0000000075CD3000-memory.dmp

Filesize
8KB

Download