Analysis
-
max time kernel
152s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
09-02-2023 07:07
Behavioral task
behavioral1
Sample
a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df.dll
Resource
win10v2004-20221111-en
General
-
Target
a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df.dll
-
Size
369KB
-
MD5
0d570f6da1c962502b0f54307b0d9abf
-
SHA1
78b84f9692c5d06e639687031758f3f2879e5844
-
SHA256
a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df
-
SHA512
0407c0e365514951dbb96dab5b9c31c24606fab62be67b262b030d3da79f2df98a38b0a43a846a785c92463318d13ce582a0b3aa345dcdd3de01a2247b6b8bc1
-
SSDEEP
6144:ey4m1oD0paFOpmC68BiK9cp7W0tp818tJT0oVlTB9PYa5haic:yeS0oA68iKydpo8tVP3BZH
Malware Config
Signatures
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 456 4340 WerFault.exe rundll32.exe 3276 4340 WerFault.exe rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 4340 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3536 wrote to memory of 4340 3536 rundll32.exe rundll32.exe PID 3536 wrote to memory of 4340 3536 rundll32.exe rundll32.exe PID 3536 wrote to memory of 4340 3536 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a77026369a419d406016777fa7e8e6807a4c2ae6e2dab8a86e49ed9c53ae56df.dll,#12⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 6083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 6043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4340 -ip 43401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4340 -ip 43401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4340 -ip 43401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4340-132-0x0000000000000000-mapping.dmp
-
memory/4340-133-0x0000000010000000-0x00000000100D2000-memory.dmpFilesize
840KB
-
memory/4340-135-0x0000000010000000-0x00000000100D2000-memory.dmpFilesize
840KB
-
memory/4340-136-0x0000000010000000-0x00000000100D2000-memory.dmpFilesize
840KB
-
memory/4340-134-0x0000000010000000-0x00000000100D2000-memory.dmpFilesize
840KB