12d5db621bcd8ace97296834a9526fb6a4cfc50cc8b40584fd247d5f3c277eb1 | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-12-2022 09:24

Sharing

Report Analysis Logs

General

Target

calc.dll
Size

204KB
MD5

9590936149f3ad655e6c6e6e40ffd309
SHA1

580c1ca3d1d22bfe3ebbf47de4e82465217f3230
SHA256

39c19171dd55fa81f755f1aa3e431999ece285f50af34331e651a25952e2906e
SHA512

b1eaf581df67fbac53fc0f1b2061737a15470b415c8e2d429405704a3b60d27cad41ca84020e7a40d43e21760aad542e1db431b7cd9c499c5b1bbb1bc1db314b
SSDEEP

3072:5dFna2JSkcrnYSdM50RAXSPy0qUiS0Lxh5H4evyzUhjQUc5Gy:FRYkcrY4MCIt07iPlvU0jy

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2008 2040 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2040	2012	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 2008	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2008	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2008	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 2008	2040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\calc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\calc.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 232
3⤵
- Program crash
PID:2008

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-56-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000000000000-mapping.dmp

Download
memory/2040-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download