Analysis
-
max time kernel
131s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09-02-2023 19:59
Static task
static1
Behavioral task
behavioral1
Sample
suspicious.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
suspicious.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
suspicious.dll
-
Size
1.7MB
-
MD5
ace1226b3f17cf0cb6e6c3ceae7b95d8
-
SHA1
369ca9e31a31709641c2491bb895d55b20d5c90c
-
SHA256
a5fc814ab0a22c9684cb7587ffed6a7188e0a061ef4a268b4997e38a5f86aabd
-
SHA512
dba25ddeffe58e9258ce39aa3bd1509b6ce115fb6f097992fcce97134f8c7a212dfe5a4061c5c5fadaeba131b3336ccdb3cd79aa01dc53b4f063f6ebd7212540
-
SSDEEP
24576:nrj3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgE7v99de7:f3nCeCiT8aHxyM18z+XatEh9de
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4832 4768 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2220 wrote to memory of 4768 2220 rundll32.exe 81 PID 2220 wrote to memory of 4768 2220 rundll32.exe 81 PID 2220 wrote to memory of 4768 2220 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\suspicious.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\suspicious.dll,#12⤵PID:4768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 6003⤵
- Program crash
PID:4832
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4768 -ip 47681⤵PID:400