fdd7ebd0eafe38d33e0a3d42fdc4935266b35da063bc6874bc0ffd3cb05ff892 | Triage

Resubmissions

22-09-2022 16:56

220922-vfsc9sfgal 10

22-09-2022 16:46

220922-vacevsffgq 3

13-09-2022 17:49

220913-wd1gjacabj 3

Analysis

max time kernel
61s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2022 16:56

Sharing

Report Analysis Logs

General

Target

25c5264d16b42bf798913e90ecf32ea2.dll
Size

2.7MB
MD5

25c5264d16b42bf798913e90ecf32ea2
SHA1

24529aaf2ca70f05e148d49cd9f6a1fe398ec129
SHA256

fdd7ebd0eafe38d33e0a3d42fdc4935266b35da063bc6874bc0ffd3cb05ff892
SHA512

4d6124a0ca76b81cc9c899341d5e6384e3acc19cfad36ea4780f5d6c30968b92535acd347b36d82121ed8a845d372e2c0398a7c9815264a9da287a5440070dd5
SSDEEP

49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcT2ek:P1Kqvv07noI7lOOYcl

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5064 4552 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4652 wrote to memory of 4552	4652	rundll32.exe	rundll32.exe
PID 4652 wrote to memory of 4552	4652	rundll32.exe	rundll32.exe
PID 4652 wrote to memory of 4552	4652	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c5264d16b42bf798913e90ecf32ea2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25c5264d16b42bf798913e90ecf32ea2.dll,#1
2⤵
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 560
3⤵
- Program crash
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4552 -ip 4552
1⤵
PID:2348

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4552-132-0x0000000000000000-mapping.dmp

Download