Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08/03/2023, 10:22
Behavioral task
behavioral1
Sample
3100-135-0x00000000021E0000-0x00000000021ED000-memory.dll
Resource
win7-20230220-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3100-135-0x00000000021E0000-0x00000000021ED000-memory.dll
Resource
win10v2004-20230220-en
2 signatures
150 seconds
General
-
Target
3100-135-0x00000000021E0000-0x00000000021ED000-memory.dll
-
Size
52KB
-
MD5
933e139e2413c29e3eab9c4364f9dd9f
-
SHA1
d434e993f45e45638ceb6d268c11ddb060c41904
-
SHA256
3ebc9758d14cac0bd35277ca275c078eba9222784270b19f10da269295ab192c
-
SHA512
c990947aaa30dc15076fd799fd1c05eba51c023c0a0935233f764bf9199f871dc91bdf281423681eb3824435543e97b6836bf74aa29c5063863f0581cc322700
-
SSDEEP
768:5EQAH8qFrgc+QxmjW/I4WIQR7GHzx2WZ23KNech/+Qiqpi6dMhhK3D1Gc:mBcq5+W/ILFRId2Wdhtiq86dMeD1Gc
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2024 1724 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1724 1712 rundll32.exe 28 PID 1712 wrote to memory of 1724 1712 rundll32.exe 28 PID 1712 wrote to memory of 1724 1712 rundll32.exe 28 PID 1712 wrote to memory of 1724 1712 rundll32.exe 28 PID 1712 wrote to memory of 1724 1712 rundll32.exe 28 PID 1712 wrote to memory of 1724 1712 rundll32.exe 28 PID 1712 wrote to memory of 1724 1712 rundll32.exe 28 PID 1724 wrote to memory of 2024 1724 rundll32.exe 29 PID 1724 wrote to memory of 2024 1724 rundll32.exe 29 PID 1724 wrote to memory of 2024 1724 rundll32.exe 29 PID 1724 wrote to memory of 2024 1724 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3100-135-0x00000000021E0000-0x00000000021ED000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3100-135-0x00000000021E0000-0x00000000021ED000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1963⤵
- Program crash
PID:2024
-
-