Analysis
-
max time kernel
90s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2022 17:46
Behavioral task
behavioral1
Sample
800619c7ef9baa08d8b9166afc95ce75.dll
Resource
win7-20220812-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
800619c7ef9baa08d8b9166afc95ce75.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
800619c7ef9baa08d8b9166afc95ce75.dll
-
Size
2.7MB
-
MD5
800619c7ef9baa08d8b9166afc95ce75
-
SHA1
e97b1c9da42e67666a46ac930187695d3987d1a5
-
SHA256
b8490732ccb34fdd76910ee15aa3eced95ef445f2ab287d45181f98f44742df1
-
SHA512
abe650bc340f6c1dc60fbc0296c0678cefa9249cbeb2b315ea02565d78c39db3c31679190fe1012e70a7a992cc47fc6053926b928c945b6c9d50f24deb4aa61f
-
SSDEEP
49152:Jzl1rpbUrqvv0v2rQVt8nqwI7lOOYcS2ek:P1Kqvv07noI7lOOYcW
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2608 4556 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4760 wrote to memory of 4556 4760 rundll32.exe 83 PID 4760 wrote to memory of 4556 4760 rundll32.exe 83 PID 4760 wrote to memory of 4556 4760 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\800619c7ef9baa08d8b9166afc95ce75.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\800619c7ef9baa08d8b9166afc95ce75.dll,#12⤵PID:4556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 5603⤵
- Program crash
PID:2608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4556 -ip 45561⤵PID:804