Analysis
-
max time kernel
61s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 06:23
Static task
static1
Behavioral task
behavioral1
Sample
1d84a264d48d733f34da0177bd01370ecbe905be098b1ffb408a58cacb4221ff.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1d84a264d48d733f34da0177bd01370ecbe905be098b1ffb408a58cacb4221ff.dll
Resource
win10v2004-20220901-en
General
-
Target
1d84a264d48d733f34da0177bd01370ecbe905be098b1ffb408a58cacb4221ff.dll
-
Size
112KB
-
MD5
c08446d7e783c2fc55f90411dea97a48
-
SHA1
4df1da4cd52e41eb003369423f49536f840faf67
-
SHA256
1d84a264d48d733f34da0177bd01370ecbe905be098b1ffb408a58cacb4221ff
-
SHA512
751b370176a2138dd6c55c67e4dba30ef87795cbac7971dab17e367b3a66b41883ca65a5b2690e6e6b93b779a23143d6d4ad97b1259aa349ac5570460f0c8f83
-
SSDEEP
1536:dUM0u5E5MkQiqniMzykNpNykXteBVSc6iepQjoSPXAIxpVT9i1B34aaY/POG:ddhhSqxTxtYVSc6LaXlpVE3l
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 5012 2204 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2204 1960 rundll32.exe 81 PID 1960 wrote to memory of 2204 1960 rundll32.exe 81 PID 1960 wrote to memory of 2204 1960 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1d84a264d48d733f34da0177bd01370ecbe905be098b1ffb408a58cacb4221ff.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1d84a264d48d733f34da0177bd01370ecbe905be098b1ffb408a58cacb4221ff.dll,#12⤵PID:2204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 6243⤵
- Program crash
PID:5012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2204 -ip 22041⤵PID:4844