Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19/05/2023, 11:30
Static task
static1
Behavioral task
behavioral1
Sample
cf1a5b3d47877764d98475a2e3cbd44d6163647d88a65246d2fe344eabd5470f.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cf1a5b3d47877764d98475a2e3cbd44d6163647d88a65246d2fe344eabd5470f.dll
Resource
win10v2004-20230220-en
General
-
Target
cf1a5b3d47877764d98475a2e3cbd44d6163647d88a65246d2fe344eabd5470f.dll
-
Size
309KB
-
MD5
f557aef21baa74f8686353f39b6a24f2
-
SHA1
430c01911d02c8c266f54412122f44a974afaa34
-
SHA256
cf1a5b3d47877764d98475a2e3cbd44d6163647d88a65246d2fe344eabd5470f
-
SHA512
7f6f91832668d0a718c5c4758b9d1ce116ada7f47ec9f40773039da948176f58c584f7d1007d61544a70a293bf2a54ff8ac8f68167878e76b46ee019c3a51e64
-
SSDEEP
6144:MU2g+xFPq4i1ztOP9OV16csA7kDAO1TBG8x8pNigJA1/BqZ:MU2DFhAJOP9y63a2XTg8x8pNi//BqZ
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1228 632 WerFault.exe 27 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 632 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1444 wrote to memory of 632 1444 rundll32.exe 27 PID 1444 wrote to memory of 632 1444 rundll32.exe 27 PID 1444 wrote to memory of 632 1444 rundll32.exe 27 PID 1444 wrote to memory of 632 1444 rundll32.exe 27 PID 1444 wrote to memory of 632 1444 rundll32.exe 27 PID 1444 wrote to memory of 632 1444 rundll32.exe 27 PID 1444 wrote to memory of 632 1444 rundll32.exe 27 PID 632 wrote to memory of 1228 632 rundll32.exe 28 PID 632 wrote to memory of 1228 632 rundll32.exe 28 PID 632 wrote to memory of 1228 632 rundll32.exe 28 PID 632 wrote to memory of 1228 632 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf1a5b3d47877764d98475a2e3cbd44d6163647d88a65246d2fe344eabd5470f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf1a5b3d47877764d98475a2e3cbd44d6163647d88a65246d2fe344eabd5470f.dll,#12⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 2243⤵
- Program crash
PID:1228
-
-