ee868be2d9b4762b0568773ef5b2d5dd16f9cd46b0785ea178b24a44c0fa25ae | Triage

Analysis

max time kernel
22s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-10-2022 16:14

Sharing

Report Analysis Logs

General

Target

clear.dll
Size

2.8MB
MD5

c04feb8231da5188c2fd829a04b08c80
SHA1

a70ebd8d5ae4a926f1227364c014be27e08fd8a0
SHA256

231d52de3ac6088dbf23871340e5495af9e441e0fd56f562f0f22bcb0d7a1f3e
SHA512

eadf248f4fe599af7b889ff1b143eb09ee5b3d5c68e922d06f5e6643c15fadaddc8a61d17fc8ab24991aba75d393e36790a8d5d94b5acd11083a635e2d920b6a
SSDEEP

49152:LUV3vtDSorKBLIXzOp4OuDkSSpc0hRpCLOdX+il7WAVnq:QDdrKBMCN6

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	668	WerFault.exe	20

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 1712	668	rundll32.exe	28
PID 668 wrote to memory of 1712	668	rundll32.exe	28
PID 668 wrote to memory of 1712	668	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\clear.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 668 -s 84
  2⤵
  - Program crash
  PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads