Analysis
-
max time kernel
22s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07-11-2022 10:28
Static task
static1
Behavioral task
behavioral1
Sample
cb72723d8e7f1418dc53a3f109ffc766ed5ea3c9206c1d7eb277331a7e56bebc.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
cb72723d8e7f1418dc53a3f109ffc766ed5ea3c9206c1d7eb277331a7e56bebc.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
cb72723d8e7f1418dc53a3f109ffc766ed5ea3c9206c1d7eb277331a7e56bebc.dll
-
Size
660KB
-
MD5
08e282ad40651510ea599e33c79b8110
-
SHA1
e99aa932dcc4eea61c3156c13aa6ca27f8d72758
-
SHA256
cb72723d8e7f1418dc53a3f109ffc766ed5ea3c9206c1d7eb277331a7e56bebc
-
SHA512
e04e2542b558c13643a80a95de812aff85afa195ce219412729b4c0b294108ca7ef867373d8e9a056ff5430fc2eaef1afed2c5111aeee848df35660844c129f5
-
SSDEEP
12288:tP1bG5f6Iby4mDROTaw1DxGUSamM5lNwSJUtuGKYNT4S:xVGdjmF2dXGU9NwSJUtbT7
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1232 1352 WerFault.exe 27 -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 860 wrote to memory of 1352 860 rundll32.exe 27 PID 860 wrote to memory of 1352 860 rundll32.exe 27 PID 860 wrote to memory of 1352 860 rundll32.exe 27 PID 860 wrote to memory of 1352 860 rundll32.exe 27 PID 860 wrote to memory of 1352 860 rundll32.exe 27 PID 860 wrote to memory of 1352 860 rundll32.exe 27 PID 860 wrote to memory of 1352 860 rundll32.exe 27 PID 1352 wrote to memory of 1232 1352 rundll32.exe 28 PID 1352 wrote to memory of 1232 1352 rundll32.exe 28 PID 1352 wrote to memory of 1232 1352 rundll32.exe 28 PID 1352 wrote to memory of 1232 1352 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cb72723d8e7f1418dc53a3f109ffc766ed5ea3c9206c1d7eb277331a7e56bebc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cb72723d8e7f1418dc53a3f109ffc766ed5ea3c9206c1d7eb277331a7e56bebc.dll,#12⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 3643⤵
- Program crash
PID:1232
-
-