500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686 | Triage

Resubmissions

14-07-2022 15:44

220714-s6vj7scbe9 10

06-07-2022 11:56

220706-n4ct6aede9 3

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
14-07-2022 15:44

Sharing

Report Analysis Logs

General

Target

500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686.dll
Size

163KB
MD5

5ffc31841eb3b77f41f0ace61becd8fd
SHA1

87aa3c10f8a291fe4eceeb18e01a2aa1856966f3
SHA256

500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686
SHA512

442e7d7537833a5ecdff6e5e892671376ee8e56b120a8c5dda32520e5fe499d85b7204d56637f4fd6e74f4cdf9e0e19efd80fe6d6bc8e118a73e9fa61ea444f6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

616 1764 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1764 wrote to memory of 616	1764	rundll32.exe	WerFault.exe
PID 1764 wrote to memory of 616	1764	rundll32.exe	WerFault.exe
PID 1764 wrote to memory of 616	1764	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\500905187d6b2d387fed36c8a1a51f8a2d58ebcb0829c81cea81ad08d3d35686.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1764 -s 84
  2⤵
  - Program crash
  PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-54-0x0000000000000000-mapping.dmp

Download