befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f | Triage

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-03-2023 17:42

Sharing

Report Analysis Logs

General

Target

loader_p1_dll_64_n1_x64_inf.dll53.dll
Size

842KB
MD5

1821abde4a17d5c775e197217ca2a1d6
SHA1

b0bf8c2ed7ae2e6ecb5eb2275015343a712ab8b3
SHA256

befeb1ab986fae9a54d4761d072bf50fdbff5c6b1b89b66a6790a3f0bfc4243f
SHA512

e5d46a376692fe2348ec26b94c93ba304c9cc2da5ed81b734c894b3ec473a22f04591bee4b841a142f5b7659f5e4495a579aa0e49abe21002796b4647b06f73c
SSDEEP

24576:iX/wM8bxdVOcVYXNg31qU1c8/UxMzFni:i9EKNI8U68/U+zFn

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1956 1928 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1928 wrote to memory of 1956	1928	rundll32.exe	WerFault.exe
PID 1928 wrote to memory of 1956	1928	rundll32.exe	WerFault.exe
PID 1928 wrote to memory of 1956	1928	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\loader_p1_dll_64_n1_x64_inf.dll53.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1928 -s 84
2⤵
- Program crash
PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads