Analysis
-
max time kernel
144s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2022 02:24
Behavioral task
behavioral1
Sample
1708-59-0x00000000001E0000-0x000000000020A000-memory.dll
Resource
win7-20221111-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1708-59-0x00000000001E0000-0x000000000020A000-memory.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
1708-59-0x00000000001E0000-0x000000000020A000-memory.dll
-
Size
168KB
-
MD5
dd6b60bc4ca6f534b10d8562d4486b91
-
SHA1
8b9431ec4a82feee784b4c5d76a86aac6c8e9471
-
SHA256
105b8e658db12f45cca436abdaf3796716e3d1d3d1202f5b019d4dab54ce7ecf
-
SHA512
f15d2c2d6e030615b7c2a922fd635aa1b480ddce1b4b479559079c0f4af2a2078ea862d476c547ede15174cd83a8f9c327ff1fd019f930119d6bb653f35bc603
-
SSDEEP
3072:pe4OwkXvoSRo1XxF8IpaPui6A8Jis34sTBfN1va83LXO/yaHk:pGfopbmkaPuiv8Jx34sTBFM83L+/s
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1716 4544 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4996 wrote to memory of 4544 4996 rundll32.exe rundll32.exe PID 4996 wrote to memory of 4544 4996 rundll32.exe rundll32.exe PID 4996 wrote to memory of 4544 4996 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1708-59-0x00000000001E0000-0x000000000020A000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1708-59-0x00000000001E0000-0x000000000020A000-memory.dll,#12⤵PID:4544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 5643⤵
- Program crash
PID:1716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4544 -ip 45441⤵PID:4160
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4544-132-0x0000000000000000-mapping.dmp