Analysis
-
max time kernel
40s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 07:50
Behavioral task
behavioral1
Sample
1708-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1708-54-0x0000000180000000-0x0000000180009000-memory.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
1708-54-0x0000000180000000-0x0000000180009000-memory.dll
-
Size
36KB
-
MD5
54ae28dee585eacd0b89edd39cf1f277
-
SHA1
ae67ca99758a627120f88f73c2240b2dd97a9d7f
-
SHA256
7ab051fdcbcddf8b678a6164c3a987440f713d7ecef0c326651a40d53d5d10fc
-
SHA512
e04e718d47eb05a2dea95733ececdb331571f135262440780d47e9e346137b6531907cff9a842dd0fc0446bb420020245edd2d7a5ba054e0abbb19cdad6eec1b
-
SSDEEP
192:hHVMfa7TTCjJSixzPSAA56RCK7Yu/VPgwIRvXBAQYfPq/3Kb:h1Mf0gJSix2AA56RCiZVEGQYnq/6b
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 888 1296 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1296 wrote to memory of 888 1296 rundll32.exe WerFault.exe PID 1296 wrote to memory of 888 1296 rundll32.exe WerFault.exe PID 1296 wrote to memory of 888 1296 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1708-54-0x0000000180000000-0x0000000180009000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1296 -s 562⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/888-54-0x0000000000000000-mapping.dmp