Analysis
-
max time kernel
29s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22/04/2023, 23:23
Static task
static1
Behavioral task
behavioral1
Sample
9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll
Resource
win10v2004-20230220-en
General
-
Target
9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll
-
Size
4.0MB
-
MD5
0c1b70cab75fe8561e95e2a33ea76c4e
-
SHA1
3e902320ff44fd40c3c593f03175b0036e05ade8
-
SHA256
9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1
-
SHA512
2cb5b2c5d85d8e425724ab3c3992248e5712c769b3ccafc1ee0e8803f2177f2c92a1393b0a259a0f82965d109a016d31a918eb13de9edb95d8e7326a39f284b2
-
SSDEEP
98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGz3:opLDM9RUYqBfO9nP5GIky+f9qLE
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1712 1996 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1996 1960 rundll32.exe 27 PID 1960 wrote to memory of 1996 1960 rundll32.exe 27 PID 1960 wrote to memory of 1996 1960 rundll32.exe 27 PID 1960 wrote to memory of 1996 1960 rundll32.exe 27 PID 1960 wrote to memory of 1996 1960 rundll32.exe 27 PID 1960 wrote to memory of 1996 1960 rundll32.exe 27 PID 1960 wrote to memory of 1996 1960 rundll32.exe 27 PID 1996 wrote to memory of 1712 1996 rundll32.exe 28 PID 1996 wrote to memory of 1712 1996 rundll32.exe 28 PID 1996 wrote to memory of 1712 1996 rundll32.exe 28 PID 1996 wrote to memory of 1712 1996 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f2944e822916b8a563c89828d0243d2598a8b17b20d152ff93eacde5b2ee7c1.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 2483⤵
- Program crash
PID:1712
-
-