Analysis
-
max time kernel
140s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20-06-2023 05:33
Behavioral task
behavioral1
Sample
142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c.dll
Resource
win10v2004-20230220-en
General
-
Target
142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c.dll
-
Size
2.5MB
-
MD5
b7a4f8f906be5614f88762077f47b125
-
SHA1
e4c07a029e2fd5b899576b9ab1aa2035fc37bdaa
-
SHA256
142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c
-
SHA512
09d204701f42883419aa48ddb916a0f2637da3d7192ed6529e22651ca996f24663ee8167e8b659d83bfa9cfc9e821e3ab41c25426a07850ec354c58b062f01da
-
SSDEEP
49152:fxUUFD9hexlqxR7cqjilsIDXwwFYdCpob+Cyd88ILOlPDLCVkYI0Jy1:fxzD9hexlqxhIlVYwQwquaG0y1
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 992 1308 WerFault.exe rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
rundll32.exepid process 1308 rundll32.exe 1308 rundll32.exe 1308 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1192 wrote to memory of 1308 1192 rundll32.exe rundll32.exe PID 1192 wrote to memory of 1308 1192 rundll32.exe rundll32.exe PID 1192 wrote to memory of 1308 1192 rundll32.exe rundll32.exe PID 1192 wrote to memory of 1308 1192 rundll32.exe rundll32.exe PID 1192 wrote to memory of 1308 1192 rundll32.exe rundll32.exe PID 1192 wrote to memory of 1308 1192 rundll32.exe rundll32.exe PID 1192 wrote to memory of 1308 1192 rundll32.exe rundll32.exe PID 1308 wrote to memory of 992 1308 rundll32.exe WerFault.exe PID 1308 wrote to memory of 992 1308 rundll32.exe WerFault.exe PID 1308 wrote to memory of 992 1308 rundll32.exe WerFault.exe PID 1308 wrote to memory of 992 1308 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c.dll,#12⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 3843⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-54-0x0000000001E30000-0x00000000024A9000-memory.dmpFilesize
6.5MB
-
memory/1308-55-0x0000000001E30000-0x00000000024A9000-memory.dmpFilesize
6.5MB
-
memory/1308-56-0x0000000001E30000-0x00000000024A9000-memory.dmpFilesize
6.5MB
-
memory/1308-57-0x0000000001E30000-0x00000000024A9000-memory.dmpFilesize
6.5MB
-
memory/1308-58-0x0000000000800000-0x0000000000940000-memory.dmpFilesize
1.2MB
-
memory/1308-59-0x0000000000800000-0x0000000000940000-memory.dmpFilesize
1.2MB
-
memory/1308-61-0x0000000000800000-0x0000000000940000-memory.dmpFilesize
1.2MB
-
memory/1308-62-0x0000000000800000-0x0000000000940000-memory.dmpFilesize
1.2MB
-
memory/1308-63-0x0000000001E30000-0x00000000024A9000-memory.dmpFilesize
6.5MB
-
memory/1308-65-0x0000000000800000-0x0000000000940000-memory.dmpFilesize
1.2MB
-
memory/1308-64-0x0000000000800000-0x0000000000940000-memory.dmpFilesize
1.2MB
-
memory/1308-60-0x0000000001E30000-0x00000000024A9000-memory.dmpFilesize
6.5MB
-
memory/1308-66-0x0000000001E30000-0x00000000024A9000-memory.dmpFilesize
6.5MB
-
memory/1308-67-0x0000000001E30000-0x00000000024A9000-memory.dmpFilesize
6.5MB
-
memory/1308-68-0x0000000001E30000-0x00000000024A9000-memory.dmpFilesize
6.5MB