ef8f5c1d2c0ebe7d10ef045ceeaddc5eb682e76f8930fa79cc37cfc3cc454ea2 | Triage

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 11:28

Sharing

Report Analysis Logs

General

Target

ef8f5c1d2c0ebe7d10ef045ceeaddc5eb682e76f8930fa79cc37cfc3cc454ea2.dll
Size

4KB
MD5

14c0959db62cea1723576f2d7a696b40
SHA1

597f5393d6a23ebae0cde2bb4d9ca0ef10e3d082
SHA256

ef8f5c1d2c0ebe7d10ef045ceeaddc5eb682e76f8930fa79cc37cfc3cc454ea2
SHA512

5da3bcafdd768d9991bdeb3233f43e092be1c0894de484741a9bc1fd026eb24367a19df8bdb7f468b9065231ef4b039d4bfbfd3351b86688be26019d67958718

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4952	4940	WerFault.exe	60

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4940	4396	rundll32.exe	60
PID 4396 wrote to memory of 4940	4396	rundll32.exe	60
PID 4396 wrote to memory of 4940	4396	rundll32.exe	60

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef8f5c1d2c0ebe7d10ef045ceeaddc5eb682e76f8930fa79cc37cfc3cc454ea2.dll,#1
1⤵
PID:4940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 560
  2⤵
  - Program crash
  PID:4952

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef8f5c1d2c0ebe7d10ef045ceeaddc5eb682e76f8930fa79cc37cfc3cc454ea2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4940 -ip 4940
1⤵
PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4940-132-0x0000000000000000-mapping.dmp

Download