Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 11:25
Static task
static1
Behavioral task
behavioral1
Sample
f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll
Resource
win10v2004-20220812-en
General
-
Target
f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll
-
Size
216KB
-
MD5
3e208db3e116a7b228747f420fa95ce1
-
SHA1
b848d89e79aec8763a841090c0536339c657dd5f
-
SHA256
f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5
-
SHA512
73ba879d6303e6b981385f4679c408ddd80d43d99da8a470be858fc173808d8e1d87271e613b5a9500841b9ddcc0b2da6b4814aa470868472bf62c2f617b3475
-
SSDEEP
3072:emnvIvjsmmhclUfrECdq6pamg3srY6H5GTfrFFzTUN+AtgUT5:qvon5bQmeeE5FzTk8y
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4308 4200 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4900 wrote to memory of 4200 4900 rundll32.exe 82 PID 4900 wrote to memory of 4200 4900 rundll32.exe 82 PID 4900 wrote to memory of 4200 4900 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f0b20525d97e39bb9f598cf2fb33fa75c8e4e302c4afc0fa2bddc3fa035210f5.dll,#12⤵PID:4200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 5923⤵
- Program crash
PID:4308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4200 -ip 42001⤵PID:4724