Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/02/2023, 17:06
Static task
static1
Behavioral task
behavioral1
Sample
01 (2).dll
Resource
win7-20220901-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
01 (2).dll
Resource
win10v2004-20221111-en
10 signatures
150 seconds
General
-
Target
01 (2).dll
-
Size
418KB
-
MD5
ab28ce01947066084d4af6583a6d3b54
-
SHA1
b1d69acda90232d836bc69ea3cbd9465ce3afdd3
-
SHA256
73c6b431eb5a92719ba406a765d011aa709234af3675e9de4eff9c5f9edd3fe3
-
SHA512
b99e5f2348f653da27a3ebc53da47dba72fc0b94ceaaf290e8f7d23cf0ef45095c13a9a101b235c6c45873a5feae35eedf402e5ea90bea5f12274cce103ba307
-
SSDEEP
6144:+1bpx1ymed01f3UBRxFoNgKIlp6Ydc2ZiKm5baKrE7eh7PilAFNZzdnLf:sN8d0dkfxFoNgKIlbdc2IOaGlAFnBT
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1200 852 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1396 wrote to memory of 852 1396 rundll32.exe 27 PID 1396 wrote to memory of 852 1396 rundll32.exe 27 PID 1396 wrote to memory of 852 1396 rundll32.exe 27 PID 1396 wrote to memory of 852 1396 rundll32.exe 27 PID 1396 wrote to memory of 852 1396 rundll32.exe 27 PID 1396 wrote to memory of 852 1396 rundll32.exe 27 PID 1396 wrote to memory of 852 1396 rundll32.exe 27 PID 852 wrote to memory of 1200 852 rundll32.exe 28 PID 852 wrote to memory of 1200 852 rundll32.exe 28 PID 852 wrote to memory of 1200 852 rundll32.exe 28 PID 852 wrote to memory of 1200 852 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\01 (2).dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\01 (2).dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 2243⤵
- Program crash
PID:1200
-
-