Analysis
-
max time kernel
43s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
20/07/2022, 15:43
Behavioral task
behavioral1
Sample
532-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win7-20220718-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
532-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win10v2004-20220715-en
1 signatures
150 seconds
General
-
Target
532-54-0x0000000180000000-0x0000000180009000-memory.dll
-
Size
36KB
-
MD5
4c50e43548dbc8b8478386ad003e48d9
-
SHA1
d3bd22f32d623643a2d59955fb61eecf558db142
-
SHA256
2cfd9faf2fcc550b434bf8927ab588aa834ae680843a6b2c110347a863cde47a
-
SHA512
3bb467121df0c3267edfc1f2e998b64f045464d9fe6daeb301c3986d1aa1bb1bbb1fa82ad82a1452c0348b238215f74b623c0bc8febb698b8a1c62c640e939fc
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1412 2032 WerFault.exe 14 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1412 2032 rundll32.exe 28 PID 2032 wrote to memory of 1412 2032 rundll32.exe 28 PID 2032 wrote to memory of 1412 2032 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\532-54-0x0000000180000000-0x0000000180009000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2032 -s 562⤵
- Program crash
PID:1412
-