Analysis
-
max time kernel
137s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 13:32
Behavioral task
behavioral1
Sample
eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll
Resource
win7-20220812-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll
-
Size
106KB
-
MD5
6ae956e793b2b8f16ea402d695b8c660
-
SHA1
c7d22be8cb35db1c494c4a8e2154055687d96445
-
SHA256
eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59
-
SHA512
1c1f9326941dff1fe30a8c901c77c50f670472db434e484c35a5d60c226fb4eecec807e116c9dd5370fb86af6c960e835eda98e8e1d182f5ad6f7d08b933d6fe
-
SSDEEP
3072:Jds7xEm5K7oIzKlkcw+gF48UJpOVnjwZO7:Ts7lG+kdLF4DJpAnjt
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4880 2524 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2524 2436 rundll32.exe 81 PID 2436 wrote to memory of 2524 2436 rundll32.exe 81 PID 2436 wrote to memory of 2524 2436 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eebd0f2ab7ef40775dea11dbfa57c1b4c671b700a9b89175fe5b11b0c0a27f59.dll,#12⤵PID:2524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 6603⤵
- Program crash
PID:4880
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2524 -ip 25241⤵PID:4924