3447ba5b8c816bf1f1429b2f130603efcb7b5d4b3bc004f4694dc2fb68ec9780 | Triage

Resubmissions

09/10/2022, 13:56

221009-q8rj8ahbhr 10

09/10/2022, 13:55

221009-q78r4shbhn 3

09/10/2022, 13:38

221009-qxcxpahad5 3

07/10/2022, 14:03

221007-rct6xachbp 3

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/10/2022, 14:03

Sharing

Report Analysis Logs

General

Target

8720/pardons.dll
Size

2.7MB
MD5

c7000fd6328dbc4f6a2283011188a8d7
SHA1

8b321eabb5e4932d1a403276ac839f669b71a2e0
SHA256

9cc2ef50332dd2df0abb88b6e6a1f6b3634dd06e32b4facf107e40525fb2bf58
SHA512

76d806cba3c98bb2ed12230cd5e6f53ba2b118836cf2b5a56994937a6048bbc53f0c854f1ffd89a3a396667211dc6d586482a1b4cff253e68547a74712084fdc
SSDEEP

49152:8CP/6PLKTZLk+qM/6ZakaGs810EntI9mHchyN1fPan8/v4y9:f20v/wSU1082mHzpPan0

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1988	1760	WerFault.exe	26

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1988	1760	rundll32.exe	28
PID 1760 wrote to memory of 1988	1760	rundll32.exe	28
PID 1760 wrote to memory of 1988	1760	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8720\pardons.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1760 -s 84
  2⤵
  - Program crash
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads