Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25/12/2022, 19:18
Behavioral task
behavioral1
Sample
1736-64-0x00000000001F0000-0x000000000021A000-memory.dll
Resource
win7-20221111-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1736-64-0x00000000001F0000-0x000000000021A000-memory.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
1736-64-0x00000000001F0000-0x000000000021A000-memory.dll
-
Size
168KB
-
MD5
5d843e4930e7b4877505a27fb0d9505b
-
SHA1
38788bbc88ec4eac03c1f7fb15dec16bc1b392db
-
SHA256
7397ff10089cfa1797490fabbf688d4e04df0e262df5203612a4c40da3009a00
-
SHA512
9267e4467d0dcd37c5957ded3b1baf8eaa97758e2a7b4ce6b408be50efbd9edebee79e4944516e9a1647bf168c80d93d304bf0630be1be221fd5cf46287211d2
-
SSDEEP
3072:SqIxBlqMZn69MK34UXAeJvNtbzTBfdlOCsO/ya:Su46GK34UQeJVtbzTBVH3/
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1256 1952 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1952 1976 rundll32.exe 28 PID 1976 wrote to memory of 1952 1976 rundll32.exe 28 PID 1976 wrote to memory of 1952 1976 rundll32.exe 28 PID 1976 wrote to memory of 1952 1976 rundll32.exe 28 PID 1976 wrote to memory of 1952 1976 rundll32.exe 28 PID 1976 wrote to memory of 1952 1976 rundll32.exe 28 PID 1976 wrote to memory of 1952 1976 rundll32.exe 28 PID 1952 wrote to memory of 1256 1952 rundll32.exe 29 PID 1952 wrote to memory of 1256 1952 rundll32.exe 29 PID 1952 wrote to memory of 1256 1952 rundll32.exe 29 PID 1952 wrote to memory of 1256 1952 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1736-64-0x00000000001F0000-0x000000000021A000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1736-64-0x00000000001F0000-0x000000000021A000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 1963⤵
- Program crash
PID:1256
-
-