Analysis
-
max time kernel
103s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2023, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
6f255cb234de2d9af89294c990daafc908d5469032479261838b87d6bd37b8e0.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6f255cb234de2d9af89294c990daafc908d5469032479261838b87d6bd37b8e0.dll
Resource
win10v2004-20230220-en
General
-
Target
6f255cb234de2d9af89294c990daafc908d5469032479261838b87d6bd37b8e0.dll
-
Size
4.0MB
-
MD5
c56c3f21efb89bdf561530965923e897
-
SHA1
8936da02383a5b58fa234bb37930d30ea77d5f23
-
SHA256
6f255cb234de2d9af89294c990daafc908d5469032479261838b87d6bd37b8e0
-
SHA512
21d8210ddee353183a90af1ed920d5a62035a140e25efb0c9da4437680607ffbbf86611722a7ac809bd6b4370662d4c259add044b0ededc3b14cbb85fb1baa36
-
SSDEEP
98304:dFgNfLKHcpGsCh+vyU/PukYqBFpO9zaCP5hqzzP8ky+f9DuLGzR:opLDM9RUYqBfO9nP5GIky+f9qLi
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1796 1448 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3216 wrote to memory of 1448 3216 rundll32.exe 83 PID 3216 wrote to memory of 1448 3216 rundll32.exe 83 PID 3216 wrote to memory of 1448 3216 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f255cb234de2d9af89294c990daafc908d5469032479261838b87d6bd37b8e0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f255cb234de2d9af89294c990daafc908d5469032479261838b87d6bd37b8e0.dll,#12⤵PID:1448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 6283⤵
- Program crash
PID:1796
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1448 -ip 14481⤵PID:1868