Analysis
-
max time kernel
178s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 12:21
Behavioral task
behavioral1
Sample
856-98-0x0000000010000000-0x000000001000E000-memory.dll
Resource
win7-20220901-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
856-98-0x0000000010000000-0x000000001000E000-memory.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
856-98-0x0000000010000000-0x000000001000E000-memory.dll
-
Size
56KB
-
MD5
35e59796049240e60fc2191adf95a97e
-
SHA1
802c6173aa9f19a996d9f819d1003a2bee0bdcc5
-
SHA256
4e7cfe749a10d717f573b777b15adc8d63e9ecb32570bea3f6d2891d19210fb6
-
SHA512
7250f4281a9674823d489121bf17fe82cf4dab052d1ef99ce11c1010ab8de4b39e57f3ef29dc765b5ae5d71bb9dadf14ca0948f52cfdc9cc439a51dbb20a6b0f
-
SSDEEP
768:A2gGmsx3R69vK7vjyRpq63goMWPXE2bE/JVMq2LATqeeAeOu2D2wqmLiu6:KGBx3R6KApqlaPGhVMq2LpeReOb2Pmp
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4832 1508 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2768 wrote to memory of 1508 2768 rundll32.exe rundll32.exe PID 2768 wrote to memory of 1508 2768 rundll32.exe rundll32.exe PID 2768 wrote to memory of 1508 2768 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\856-98-0x0000000010000000-0x000000001000E000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\856-98-0x0000000010000000-0x000000001000E000-memory.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 5603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1508 -ip 15081⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1508-132-0x0000000000000000-mapping.dmp