Analysis
-
max time kernel
141s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2022 02:58
Behavioral task
behavioral1
Sample
280-56-0x00000000753E0000-0x000000007545D000-memory.dll
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
280-56-0x00000000753E0000-0x000000007545D000-memory.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
280-56-0x00000000753E0000-0x000000007545D000-memory.dll
-
Size
500KB
-
MD5
16d54db2e33e731a35a82434c42f60a4
-
SHA1
e229f9b722a194d91e031cbba49414097ff69e97
-
SHA256
3b65967478381324e0ca26ee6dad3c1437622a18f2a18a9c466293b7197e0b96
-
SHA512
6e7953a590611f0226b2b9a9c48a414e8e654de1c14fffb11a1e7002f2a52d33873f61554e2b9b70d33f602950edf27c80b9936b30cd8b29b8415c09a646344f
-
SSDEEP
3072:0Ls6GOhkfm9k9H1x8Lxq6im8DqM4ozD8iP:0Ls6NhkCG78L7iqM78
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 920 2420 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 5044 wrote to memory of 4980 5044 rundll32.exe rundll32.exe PID 5044 wrote to memory of 4980 5044 rundll32.exe rundll32.exe PID 5044 wrote to memory of 4980 5044 rundll32.exe rundll32.exe PID 4980 wrote to memory of 2420 4980 rundll32.exe rundll32.exe PID 4980 wrote to memory of 2420 4980 rundll32.exe rundll32.exe PID 4980 wrote to memory of 2420 4980 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\280-56-0x00000000753E0000-0x000000007545D000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\280-56-0x00000000753E0000-0x000000007545D000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\280-56-0x00000000753E0000-0x000000007545D000-memory.dll,#13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 5644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2420 -ip 24201⤵