Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
9dcbe9fb82e0e1eaf19ee16df275af0b975e2802fd57def6329e8641ea479ff7.dll
Resource
win7-20221111-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
9dcbe9fb82e0e1eaf19ee16df275af0b975e2802fd57def6329e8641ea479ff7.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
9dcbe9fb82e0e1eaf19ee16df275af0b975e2802fd57def6329e8641ea479ff7.dll
-
Size
845KB
-
MD5
4c9e6001cbda05a9bff12314a452e1d0
-
SHA1
faab03b3de9d1a3f2f4abe030e9a58931d94a75b
-
SHA256
9dcbe9fb82e0e1eaf19ee16df275af0b975e2802fd57def6329e8641ea479ff7
-
SHA512
e1c7d17308be309ea5856279071c82e75ef1824589063a4ba47b9fa4c5c843b54da9f2ed221d15caa472d1bc7cb5dcf8bb205c00aed4749d3b00bff0e23b0c9d
-
SSDEEP
24576:FLKpjgeaxqEoPkExsYiXqOWJ23/IfMSSm:Flx6bi6pJg/yMNm
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3136 2288 WerFault.exe 76 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4232 wrote to memory of 2288 4232 rundll32.exe 76 PID 4232 wrote to memory of 2288 4232 rundll32.exe 76 PID 4232 wrote to memory of 2288 4232 rundll32.exe 76
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9dcbe9fb82e0e1eaf19ee16df275af0b975e2802fd57def6329e8641ea479ff7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9dcbe9fb82e0e1eaf19ee16df275af0b975e2802fd57def6329e8641ea479ff7.dll,#12⤵PID:2288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 6243⤵
- Program crash
PID:3136
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2288 -ip 22881⤵PID:2688