Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2023 22:16
Static task
static1
Behavioral task
behavioral1
Sample
df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3.dll
Resource
win10v2004-20230220-en
General
-
Target
df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3.dll
-
Size
5.6MB
-
MD5
20d3f1c59e49b7fbc2524f0d6e1e15ea
-
SHA1
19f89f268c1ca9c73ad076964a62bcabace70b6a
-
SHA256
df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3
-
SHA512
c2478cbe6f463a0a831dfb0ec075aece87a6e355657fccd45ebdcfeb727c03357a495f0374e910965eb76df2253455866b75c227ed2252f775a92faae256d272
-
SSDEEP
98304:fBHB2pne7a1mN1E8lkcf5YjovKqGYiOE8oLj5jIrHL3GqHqUiqaAK8L4:fv1GGE5gyjovK65E8oqjLP3faL
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2372 4644 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3376 wrote to memory of 4644 3376 rundll32.exe rundll32.exe PID 3376 wrote to memory of 4644 3376 rundll32.exe rundll32.exe PID 3376 wrote to memory of 4644 3376 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\df8fdc6b60787604ab2994a5ccb7f016a4f8022aacfa0800aa36145be308cac3.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 6883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4644 -ip 46441⤵