Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2023 01:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
consumptions.dll
Resource
win7-20230220-en
2 signatures
150 seconds
General
-
Target
consumptions.dll
-
Size
850KB
-
MD5
8512b9f61020a48cd2ddc13877c1b21c
-
SHA1
ad55d9ac7fa46cb4281579764a5e20bcf7684671
-
SHA256
3926f35d483cd224e107a1167844dbe872fd28a7bebfcca3492e9da4ebbe98e8
-
SHA512
b79a7f7c5b25f76fb9541edb4bf45f37c68003eaea75f74cdffaba617a60b495aeec8bd64abc82296123d62095dcf319ae7ae196e75e99fa51b8fe34ed922328
-
SSDEEP
12288:ovXYcP7kXn89DhAw1aUN3RFEycMFSDXxqEbHXeL/Lt72G3v0ch:mvTkXnyD6ORDccmEs3M/Lt72G3v0
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2040 828 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1720 wrote to memory of 828 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 828 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 828 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 828 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 828 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 828 1720 rundll32.exe rundll32.exe PID 1720 wrote to memory of 828 1720 rundll32.exe rundll32.exe PID 828 wrote to memory of 2040 828 rundll32.exe WerFault.exe PID 828 wrote to memory of 2040 828 rundll32.exe WerFault.exe PID 828 wrote to memory of 2040 828 rundll32.exe WerFault.exe PID 828 wrote to memory of 2040 828 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\consumptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\consumptions.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 2243⤵
- Program crash
PID:2040
-
-