Analysis
-
max time kernel
20s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:18
Static task
static1
Behavioral task
behavioral1
Sample
a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe.dll
Resource
win10v2004-20220812-en
General
-
Target
a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe.dll
-
Size
49KB
-
MD5
67ebe5a7b9951331b7092f8bceb3dd13
-
SHA1
3ef8ded2d6077ef3f55feb8245b4a8cb4e93d7fe
-
SHA256
a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe
-
SHA512
f6607bcd9188e6d8c855aa4b81d1257ee1c5cedcdbd8784c61eb353d4ec3566d2774888f3db17228fbb7f42ad612b59c45ec225357b1ff95c1ab72ee20bb4e21
-
SSDEEP
768:syUqhmQIIsDZgnswpFz9Y18Q4SnAghSBEkzlfjjD2GmCDH3lZ:rUqhmQrepgFxY182h+jyGmM
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1732 1968 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1980 wrote to memory of 1968 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1968 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1968 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1968 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1968 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1968 1980 rundll32.exe rundll32.exe PID 1980 wrote to memory of 1968 1980 rundll32.exe rundll32.exe PID 1968 wrote to memory of 1732 1968 rundll32.exe WerFault.exe PID 1968 wrote to memory of 1732 1968 rundll32.exe WerFault.exe PID 1968 wrote to memory of 1732 1968 rundll32.exe WerFault.exe PID 1968 wrote to memory of 1732 1968 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8bf51a814beb7abd9cbff9cd923c299ada603916f3b8c579cab454de671d5fe.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 2283⤵
- Program crash