6b99610411b7ad255af9c56425662e721b5fdadf64ee4414b779e06481d11f01 | Triage

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-08-2022 16:48

Sharing

Report Analysis Logs

General

Target

1660-300-0x0000000004720000-0x0000000004974000-memory.dll
Size

2.3MB
MD5

436edd4238e14bc483eed2c27ff1c775
SHA1

740f4d569f22256eff70c922f7d2e20742dc5245
SHA256

6b99610411b7ad255af9c56425662e721b5fdadf64ee4414b779e06481d11f01
SHA512

5df4ab3cfde7d5d5ca3db80beefc86439b91e028924345e1a988abd68e07444ab66aa1eb3731aa1a8cf9a1c55a00f283807667dd987362bdcc1a252a1d5f65a8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1072 1088 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1596 wrote to memory of 1088	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1088	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1088	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1088	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1088	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1088	1596	rundll32.exe	rundll32.exe
PID 1596 wrote to memory of 1088	1596	rundll32.exe	rundll32.exe
PID 1088 wrote to memory of 1072	1088	rundll32.exe	WerFault.exe
PID 1088 wrote to memory of 1072	1088	rundll32.exe	WerFault.exe
PID 1088 wrote to memory of 1072	1088	rundll32.exe	WerFault.exe
PID 1088 wrote to memory of 1072	1088	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1660-300-0x0000000004720000-0x0000000004974000-memory.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1660-300-0x0000000004720000-0x0000000004974000-memory.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 196
3⤵
- Program crash
PID:1072

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1072-56-0x0000000000000000-mapping.dmp

Download
memory/1088-54-0x0000000000000000-mapping.dmp

Download
memory/1088-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download