Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2022, 19:18
Behavioral task
behavioral1
Sample
1736-64-0x00000000001F0000-0x000000000021A000-memory.dll
Resource
win7-20221111-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1736-64-0x00000000001F0000-0x000000000021A000-memory.dll
Resource
win10v2004-20220812-en
2 signatures
150 seconds
General
-
Target
1736-64-0x00000000001F0000-0x000000000021A000-memory.dll
-
Size
168KB
-
MD5
5d843e4930e7b4877505a27fb0d9505b
-
SHA1
38788bbc88ec4eac03c1f7fb15dec16bc1b392db
-
SHA256
7397ff10089cfa1797490fabbf688d4e04df0e262df5203612a4c40da3009a00
-
SHA512
9267e4467d0dcd37c5957ded3b1baf8eaa97758e2a7b4ce6b408be50efbd9edebee79e4944516e9a1647bf168c80d93d304bf0630be1be221fd5cf46287211d2
-
SSDEEP
3072:SqIxBlqMZn69MK34UXAeJvNtbzTBfdlOCsO/ya:Su46GK34UQeJVtbzTBVH3/
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4900 872 WerFault.exe 78 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4048 wrote to memory of 872 4048 rundll32.exe 78 PID 4048 wrote to memory of 872 4048 rundll32.exe 78 PID 4048 wrote to memory of 872 4048 rundll32.exe 78
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1736-64-0x00000000001F0000-0x000000000021A000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1736-64-0x00000000001F0000-0x000000000021A000-memory.dll,#12⤵PID:872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 5603⤵
- Program crash
PID:4900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 872 -ip 8721⤵PID:4600