Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
23/07/2022, 12:08
Behavioral task
behavioral1
Sample
1668-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win7-20220715-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1668-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win10v2004-20220721-en
1 signatures
150 seconds
General
-
Target
1668-54-0x0000000180000000-0x0000000180009000-memory.dll
-
Size
36KB
-
MD5
3c3734e1c868227780e91bfda4b81d06
-
SHA1
99c95f086af71d78d05c903e7a721ae60af7c564
-
SHA256
f0439cd0d4d1c83455b6a6560c104937acf4ea9283bdc29bdadaddf581870723
-
SHA512
da54b6c1eeb2ece29b1c88a64ffaff327300449295b81535cbcfa5e886344ed9cde9fb4cfe6fa415d9c352f3152fdcd28253ebe4f340e3b8b15b9844f3c6bd02
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 620 2012 WerFault.exe 10 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2012 wrote to memory of 620 2012 rundll32.exe 27 PID 2012 wrote to memory of 620 2012 rundll32.exe 27 PID 2012 wrote to memory of 620 2012 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1668-54-0x0000000180000000-0x0000000180009000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2012 -s 562⤵
- Program crash
PID:620
-