Analysis
-
max time kernel
179s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll
Resource
win10v2004-20221111-en
General
-
Target
63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll
-
Size
412KB
-
MD5
48de75d8b4a464998121682b80475e5f
-
SHA1
2afb747092ba69f49c738197434e0cd2ad81ee2e
-
SHA256
63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099
-
SHA512
7ab4ad9bc457bc8b15e48970e75b9e4aa0dd20f051edd8078076957b7079b38676a8f281f9617847a2952d1d3e719b62f5ef62dae20c2d8b90ca31c9856b691a
-
SSDEEP
6144:yYPss2uQdVth7ae1GNbYwJYPd8Rr+Q2p73I+E7viF1T6412juFBHq+t+NB:yYF2n3th+e1GxXJ4GRq774zK2tieXL
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3892 4600 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3088 wrote to memory of 4600 3088 rundll32.exe 82 PID 3088 wrote to memory of 4600 3088 rundll32.exe 82 PID 3088 wrote to memory of 4600 3088 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\63ea21a36fc87d840c094581cc4b0a4a974c2c0910d9425f4f8eb696ae52e099.dll,#12⤵PID:4600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 5963⤵
- Program crash
PID:3892
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4600 -ip 46001⤵PID:4436