605e60232e61f543c74ae03f23d4c314d037ee408f639667338a26dfbb6c910f | Triage

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14-07-2022 04:06

Sharing

Report Analysis Logs

General

Target

605e60232e61f543c74ae03f23d4c314d037ee408f639667338a26dfbb6c910f.dll
Size

203KB
MD5

482b406d7b790fe426b0ee7ab32d19aa
SHA1

6d4c6128789904524a06898affd19b119bf4e986
SHA256

605e60232e61f543c74ae03f23d4c314d037ee408f639667338a26dfbb6c910f
SHA512

7e51cfb5aa25fd83b6151f58e7df9ab87647d44bde08566cfd49e26fd82f3b72f52a3bf4b0fafbce3a972be5f4288eec046585c6ad39b113bf9f8e63bcc199f0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1272 4496 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4424 wrote to memory of 4496	4424	rundll32.exe	rundll32.exe
PID 4424 wrote to memory of 4496	4424	rundll32.exe	rundll32.exe
PID 4424 wrote to memory of 4496	4424	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\605e60232e61f543c74ae03f23d4c314d037ee408f639667338a26dfbb6c910f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4424

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\605e60232e61f543c74ae03f23d4c314d037ee408f639667338a26dfbb6c910f.dll,#1
2⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 632
3⤵
- Program crash
PID:1272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4496 -ip 4496
1⤵
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4496-130-0x0000000000000000-mapping.dmp

Download