Analysis
-
max time kernel
261s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 05:30
Static task
static1
Behavioral task
behavioral1
Sample
bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll
Resource
win10v2004-20221111-en
General
-
Target
bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll
-
Size
120KB
-
MD5
65b77d5d20576cb6f361130b2871fe00
-
SHA1
49a48864f7db3ae2de07206fda6612754a7b7241
-
SHA256
bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb
-
SHA512
1e6cc4e1d96a04f83f58eabb5b761ac35bee358d2bd3daf5858b6674c4266f95cdf41b197c9f2b18b357b0776f140b1d80b25cddbcd24e0c3113920674b4fe06
-
SSDEEP
3072:e3XPsMtJA+CNpWIscX4Ul6yv2Ii8LCZzDp0+pQR:e3XPCN4tr0Ti8s/3Y
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1620 4252 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3352 wrote to memory of 4252 3352 rundll32.exe 82 PID 3352 wrote to memory of 4252 3352 rundll32.exe 82 PID 3352 wrote to memory of 4252 3352 rundll32.exe 82 PID 4252 wrote to memory of 1620 4252 rundll32.exe 85 PID 4252 wrote to memory of 1620 4252 rundll32.exe 85 PID 4252 wrote to memory of 1620 4252 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bae1be07637501a423204c8940f840d3d184038dd4ae4ba6dc0bc7970841f8cb.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4252 -s 5603⤵
- Program crash
PID:1620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4252 -ip 42521⤵PID:4248