Analysis
-
max time kernel
155s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 03:33
Static task
static1
Behavioral task
behavioral1
Sample
e63a3a9f0c89ff358005e976f7a3e7666b3a135d25c4394fbc120b6089ac71c1.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e63a3a9f0c89ff358005e976f7a3e7666b3a135d25c4394fbc120b6089ac71c1.dll
Resource
win10v2004-20221111-en
General
-
Target
e63a3a9f0c89ff358005e976f7a3e7666b3a135d25c4394fbc120b6089ac71c1.dll
-
Size
4.3MB
-
MD5
64f196646947529c6c4d21188ec9c4dd
-
SHA1
f2db17ef0dc389ba1e76879cbe400d1031249977
-
SHA256
e63a3a9f0c89ff358005e976f7a3e7666b3a135d25c4394fbc120b6089ac71c1
-
SHA512
c04f8c8fb9036921fd0f9e87d9935403022336cc8bdbe13d20c7311d04ef8a65cfda2a8b45e068d02ce9507693e92222583703064dac9e22edeed2a54b063da8
-
SSDEEP
98304:uBu6l4QWOabPG1f5edNM/Cw/khc5FbKEQ26PVR7m6gZ1MRGNCyI5AxV3001fiofB:qYQeohedNM/Cw/khc5FbKEV6PVR7m6gr
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 428 3644 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3652 wrote to memory of 3644 3652 rundll32.exe rundll32.exe PID 3652 wrote to memory of 3644 3652 rundll32.exe rundll32.exe PID 3652 wrote to memory of 3644 3652 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e63a3a9f0c89ff358005e976f7a3e7666b3a135d25c4394fbc120b6089ac71c1.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e63a3a9f0c89ff358005e976f7a3e7666b3a135d25c4394fbc120b6089ac71c1.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 7323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3644 -ip 36441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3644-132-0x0000000000000000-mapping.dmp