89ea4dc041dcbc17203e4ceafa4c28dfe66a4784366cc58931971fff0893cfc2 | Triage

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
12-08-2022 02:27

Sharing

Report Analysis Logs

General

Target

1976-54-0x0000000180000000-0x0000000180009000-memory.dll
Size

36KB
MD5

aacea5d2c8047f9047ff2a7a05daaf4c
SHA1

96af24963349021b2ad2a3a9e93030bad6f9fc30
SHA256

89ea4dc041dcbc17203e4ceafa4c28dfe66a4784366cc58931971fff0893cfc2
SHA512

a635df502e73093346631f63769681f1bd751132a0d7a92945dfb259b314b237b55b3c73473ce7632a03bb337a1fa71aec7f6143e0d20eda41cd1f1a1306726a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1684 1672 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1672 wrote to memory of 1684	1672	rundll32.exe	WerFault.exe
PID 1672 wrote to memory of 1684	1672	rundll32.exe	WerFault.exe
PID 1672 wrote to memory of 1684	1672	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1976-54-0x0000000180000000-0x0000000180009000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1672 -s 56
2⤵
- Program crash
PID:1684

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-54-0x0000000000000000-mapping.dmp

Download