Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
15/02/2023, 21:15
Static task
static1
Behavioral task
behavioral1
Sample
based.dll
Resource
win10-20220812-en
2 signatures
150 seconds
General
-
Target
based.dll
-
Size
215KB
-
MD5
e5de5a1548715bd431e803a68ef42f89
-
SHA1
37d3b009182161ad48dee19b67ed4856ac610e8a
-
SHA256
57106a8bd5f4ec86636ad8690232ada2c9b12de029e9ff5fecc36345286a16b1
-
SHA512
019dde503547a2caa0695c751620ea149840edee1454c65b300b96784c65a8c57373e33a8f841523caf4c1c22542a955f54bfedb7217b47b13e1886604788db8
-
SSDEEP
3072:ImjMTWEQjIB7zr75ixph0LR/hSMXlk4ZqKFya5XB67TzKwLVF8:eWRIBBKph0lhSMXlBXBWHLLVe
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4720 2840 WerFault.exe 66 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2840 2776 rundll32.exe 66 PID 2776 wrote to memory of 2840 2776 rundll32.exe 66 PID 2776 wrote to memory of 2840 2776 rundll32.exe 66
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\based.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\based.dll,#12⤵PID:2840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 6203⤵
- Program crash
PID:4720
-
-