Analysis
-
max time kernel
6s -
max time network
9s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2022 20:34
Behavioral task
behavioral1
Sample
c8f1ec2ef618dfcd254f5a9e397b70644b3ba070f0c327bae20a3054df0021c0.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c8f1ec2ef618dfcd254f5a9e397b70644b3ba070f0c327bae20a3054df0021c0.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
c8f1ec2ef618dfcd254f5a9e397b70644b3ba070f0c327bae20a3054df0021c0.dll
-
Size
6.4MB
-
MD5
37280de8b448ed3a4358120a40b42872
-
SHA1
b05209c3bcaac611763369416a18c4b8406c4fa1
-
SHA256
c8f1ec2ef618dfcd254f5a9e397b70644b3ba070f0c327bae20a3054df0021c0
-
SHA512
807ba5962fd16b0700121f70a948257e8602a2b7f15f74e871253fc8571e36900915eeecdddab2a3c26364ab9369b2c4386fbb7e2f3135641ef8f1df4784d74c
-
SSDEEP
98304:zG5fSXz5F5x+3rUQ4Qljsq75Pm9tli8VSP6W:zKfSlLsVPm9tlJW
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4348 5072 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1100 wrote to memory of 5072 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 5072 1100 rundll32.exe rundll32.exe PID 1100 wrote to memory of 5072 1100 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c8f1ec2ef618dfcd254f5a9e397b70644b3ba070f0c327bae20a3054df0021c0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c8f1ec2ef618dfcd254f5a9e397b70644b3ba070f0c327bae20a3054df0021c0.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 6443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5072 -ip 50721⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5072-132-0x0000000000000000-mapping.dmp