Behavioral Report

Analysis

max time kernel
75s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2023 10:42

Target

c73e53cbb7b98feafe27cc7de8fdad51df438e2235e91891461c5123888f73cc.dll
Size

1MB
MD5

4eb0347e66fa465f602e52c03e5c0b4b
SHA1

fdfedb72614d10766565b7f12ab87f1fdca3ea81
SHA256

c73e53cbb7b98feafe27cc7de8fdad51df438e2235e91891461c5123888f73cc
SHA512

4c909a451059628119f92b2f0c8bcd67b31f63b57d5339b6ce8fd930be5c9baf261339fdd9da820321be497df8889ce7594b7bfaadbaa43c694156651bf6c1fd
SSDEEP

49152:FtDCT6XR9MsiubS8JDv6BzxllWR08G2rBqPnkvZ4yEuuk:FQW/DiubdJL6BzxlY08G2rBqPnkJ

Score

3^/10

Program crash ⋅ 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3908 4624 WerFault.exe rundll32.exe
Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs

Processes:

rundll32.exe

pid process

4624 rundll32.exe
4624 rundll32.exe

pid	pid_target	process	target process
3908	4624	WerFault.exe	rundll32.exe

pid	process
4624	rundll32.exe
4624	rundll32.exe

Suspicious use of WriteProcessMemory ⋅ 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4704 wrote to memory of 4624	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 4624	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 4624	4704	rundll32.exe	rundll32.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4624 -ip 4624

PID:4608

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

00:00 00:00