40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3 | Triage

Resubmissions

14-07-2022 15:44

220714-s6mvcscbe7 10

06-07-2022 11:56

220706-n4a1kacdhn 3

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-07-2022 15:44

Sharing

Report Analysis Logs

General

Target

40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3.dll
Size

183KB
MD5

4ee3fb2aba3b82171e6409e253bdddb5
SHA1

f5112f83885f2ede5d648224f18d78c5e70b9493
SHA256

40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3
SHA512

9a1c134c906eb85b6802edba37074cae7b5057d15f368937c075920b001ed1491004c1b021ba0bdf8e01d13398d96ae68f5b9968d4a7bc2614d9b83a758ac6e4

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1728 1864 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1864 wrote to memory of 1728	1864	rundll32.exe	WerFault.exe
PID 1864 wrote to memory of 1728	1864	rundll32.exe	WerFault.exe
PID 1864 wrote to memory of 1728	1864	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\40de45ea45d352703a19c4a5b07013c5e748d831e9f67111a776566463c0fbd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1864 -s 84
  2⤵
  - Program crash
  PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1728-54-0x0000000000000000-mapping.dmp

Download