Analysis
-
max time kernel
145s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2023, 17:50
Behavioral task
behavioral1
Sample
3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe.dll
Resource
win7-20230220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe.dll
Resource
win10v2004-20230220-en
3 signatures
150 seconds
General
-
Target
3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe.dll
-
Size
133KB
-
MD5
6122cb7921aaa36c149a0082e5d8cf78
-
SHA1
960723d9941849279fa4f5bd65e7156e884e6a1a
-
SHA256
3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe
-
SHA512
83fc87074701460ef087dfa6b83fb2e380440da2d1338c5b677531eda5b149d219955739081f274a7a07b2ab478334f51b37962af63d246a5d06f4bc396fe712
-
SSDEEP
3072:8Uu9pqH8UHJo3VE79mCE+MCuAoyJpRnfwTBfPZAn9:8QHJolEECECbnJrnfwTBHin9
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1920 5060 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5060 rundll32.exe 5060 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1604 wrote to memory of 5060 1604 rundll32.exe 84 PID 1604 wrote to memory of 5060 1604 rundll32.exe 84 PID 1604 wrote to memory of 5060 1604 rundll32.exe 84 PID 5060 wrote to memory of 3244 5060 rundll32.exe 85 PID 5060 wrote to memory of 3244 5060 rundll32.exe 85 PID 5060 wrote to memory of 3244 5060 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3b4770892d8a8ccac1b96c40d368b08ec9d91e7ac8505b6437d0e7b619a3bbfe.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\wermgr.exeC:\Windows\SysWOW64\wermgr.exe3⤵PID:3244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 7563⤵
- Program crash
PID:1920
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5060 -ip 50601⤵PID:1792