Analysis
-
max time kernel
90s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 22:51
Static task
static1
Behavioral task
behavioral1
Sample
40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901.dll
Resource
win10v2004-20220901-en
General
-
Target
40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901.dll
-
Size
736KB
-
MD5
a145dc31e3accf25664dd91d2eff6458
-
SHA1
d97c99bf29d89987d102947c0f36f4c1d5d43cfc
-
SHA256
40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901
-
SHA512
cfd92694301151a4b25b645835dbebcded86632684ce397d352558dfa9984a6b3c22adb4468daef18624fd947473c0de7bc2918b409616101662d0a3c4388314
-
SSDEEP
12288:Zbm39NuDQwXvSaEkBr8sIkDbh2modm/Dzheaj:Zi39NQQIvSDkR8nkR2modm7zheM
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4868 4904 WerFault.exe 80 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4904 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1616 wrote to memory of 4904 1616 rundll32.exe 80 PID 1616 wrote to memory of 4904 1616 rundll32.exe 80 PID 1616 wrote to memory of 4904 1616 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\40224b10f6543ea1a26bffadfe91c22233b2828118203cbd81b528c2fd592901.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:4904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 6923⤵
- Program crash
PID:4868
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4904 -ip 49041⤵PID:4796