6e0a64ae1c914961faa708b0ff5f43c30d3c04997e05bd2add145ffe07debf2a | Triage

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-01-2023 19:26

Sharing

Report Analysis Logs

General

Target

NDAPersonalData/desktop.dll
Size

1.4MB
MD5

0f9d853f54ed0d1a800051ec718f16db
SHA1

a12bd8f8edff0743e92119527673c91d2d0888e0
SHA256

18ff52ee24dbdf6593324b52250115b6c5314e159b681a3a437e3b163d3bf6ab
SHA512

04cdae504c213aa6fa645bd3d2a948dbfa5d616b3516f5787d79f5054ee25c3938e07259e4a3d59c8a7265a4f686897859aeadc419b92adb17b5d3595eb45da2
SSDEEP

24576:mTfaPo9UzJSUrZMrZjY57tj2OM8SC/XPt8JGfZb3GW2:8fKo9uJSUrZgwtc8SC/uJGu

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

864 1108 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1108 wrote to memory of 864	1108	rundll32.exe	WerFault.exe
PID 1108 wrote to memory of 864	1108	rundll32.exe	WerFault.exe
PID 1108 wrote to memory of 864	1108	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\NDAPersonalData\desktop.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1108 -s 152
2⤵
- Program crash
PID:864

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-54-0x0000000000000000-mapping.dmp

Download