Analysis
-
max time kernel
206s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll
Resource
win10v2004-20221111-en
General
-
Target
dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll
-
Size
126KB
-
MD5
534fcff492cc54f0c26a28487c565bb6
-
SHA1
1861aa01d6c3b49e2fce26616f768ba3e031b146
-
SHA256
dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491
-
SHA512
4d5b52d1b2a14611c747c4117a2a098dc5c0627d453c55295a195320468bc72e26106476dacf694df4f29348cb2dc7d1455b0a05820b8dc20a83ff92538b2c07
-
SSDEEP
1536:AQxmkWtyMsaAkK1Q+vdwPPtS02Z2dSGkdAB9hPRO7rbEXKfyt4z0:otw51tcQCcBdAThw7roXKfHo
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1988 2772 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 224 wrote to memory of 2772 224 rundll32.exe 83 PID 224 wrote to memory of 2772 224 rundll32.exe 83 PID 224 wrote to memory of 2772 224 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbbc6b844b25a3d3ee4e0ef40da41ea320ac1bece77157d93841fda64cc27491.dll,#12⤵PID:2772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 6003⤵
- Program crash
PID:1988
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2772 -ip 27721⤵PID:3744