Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:53
Static task
static1
Behavioral task
behavioral1
Sample
e124ddfed94a860c158bf17166329880c122f8207f020cdee6c5fa01b10ea0b7.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e124ddfed94a860c158bf17166329880c122f8207f020cdee6c5fa01b10ea0b7.dll
Resource
win10v2004-20220812-en
General
-
Target
e124ddfed94a860c158bf17166329880c122f8207f020cdee6c5fa01b10ea0b7.dll
-
Size
116KB
-
MD5
83b82169b03f3ddadd0fb0d45c1cbc94
-
SHA1
e7dcaf25935d06fff3475ffd1eb1fc6e7a51e50a
-
SHA256
e124ddfed94a860c158bf17166329880c122f8207f020cdee6c5fa01b10ea0b7
-
SHA512
c476e1f433c2d7c3a29ec1405264ae176f86cb139c2212d552c3c34d654dfd5433c5128f10fb073388964281d024b009207d4834bda086573c93bf306d15b9b1
-
SSDEEP
3072:ZsfSrKYoLJIGdS/3gUNuNf1SU3UzeGkA83+LW:8SrZoLCJYKUEze3AxL
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4288 3892 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2760 wrote to memory of 3892 2760 rundll32.exe rundll32.exe PID 2760 wrote to memory of 3892 2760 rundll32.exe rundll32.exe PID 2760 wrote to memory of 3892 2760 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e124ddfed94a860c158bf17166329880c122f8207f020cdee6c5fa01b10ea0b7.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e124ddfed94a860c158bf17166329880c122f8207f020cdee6c5fa01b10ea0b7.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 6163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3892 -ip 38921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3892-132-0x0000000000000000-mapping.dmp