Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28/02/2023, 17:50
Behavioral task
behavioral1
Sample
3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe.dll
Resource
win7-20230220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe.dll
Resource
win10v2004-20230220-en
3 signatures
150 seconds
General
-
Target
3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe.dll
-
Size
133KB
-
MD5
6122cb7921aaa36c149a0082e5d8cf78
-
SHA1
960723d9941849279fa4f5bd65e7156e884e6a1a
-
SHA256
3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe
-
SHA512
83fc87074701460ef087dfa6b83fb2e380440da2d1338c5b677531eda5b149d219955739081f274a7a07b2ab478334f51b37962af63d246a5d06f4bc396fe712
-
SSDEEP
3072:8Uu9pqH8UHJo3VE79mCE+MCuAoyJpRnfwTBfPZAn9:8QHJolEECECbnJrnfwTBHin9
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1036 1508 WerFault.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1508 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 528 wrote to memory of 1508 528 rundll32.exe 28 PID 528 wrote to memory of 1508 528 rundll32.exe 28 PID 528 wrote to memory of 1508 528 rundll32.exe 28 PID 528 wrote to memory of 1508 528 rundll32.exe 28 PID 528 wrote to memory of 1508 528 rundll32.exe 28 PID 528 wrote to memory of 1508 528 rundll32.exe 28 PID 528 wrote to memory of 1508 528 rundll32.exe 28 PID 1508 wrote to memory of 1408 1508 rundll32.exe 29 PID 1508 wrote to memory of 1408 1508 rundll32.exe 29 PID 1508 wrote to memory of 1408 1508 rundll32.exe 29 PID 1508 wrote to memory of 1408 1508 rundll32.exe 29 PID 1508 wrote to memory of 1036 1508 rundll32.exe 30 PID 1508 wrote to memory of 1036 1508 rundll32.exe 30 PID 1508 wrote to memory of 1036 1508 rundll32.exe 30 PID 1508 wrote to memory of 1036 1508 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵PID:1408
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 3563⤵
- Program crash
PID:1036
-
-