2052b4ce077f8a5e26656c804ddd1887dacf0e9839986b100eca73196db46086 | Triage

Analysis

max time kernel
72s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-12-2022 14:08

Sharing

Report Analysis Logs

General

Target

fumigating/erupt.dll
Size

209KB
MD5

952c6ae48b5f7cb5977f9ce5159944b7
SHA1

ec0ee94c0da39681e3ff7b78d2b1c6b63e76f9e5
SHA256

898a12fb7193c8260e9a8b9afc177b34608a9eeb1b927b895d9033e86185757d
SHA512

dfa53c3224888e73d9728fcdf605c0eaad8ed96bfdd7276f44be25c2292756a1e1a504c50ca525227d23e42d7045120ceab7e8f0cd84e992997d9376a5857143
SSDEEP

6144:z7N2DFx/kYWK4XDfAW2J//+777777Lw9oHMAqL4OF3u8:z5O//E777777LwmqLzF3u8

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

912 1312 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1312 wrote to memory of 912	1312	rundll32.exe	WerFault.exe
PID 1312 wrote to memory of 912	1312	rundll32.exe	WerFault.exe
PID 1312 wrote to memory of 912	1312	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fumigating\erupt.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1312 -s 84
2⤵
- Program crash
PID:912

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-54-0x0000000000000000-mapping.dmp

Download