Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2023 05:33
Behavioral task
behavioral1
Sample
142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c.dll
Resource
win10v2004-20230220-en
General
-
Target
142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c.dll
-
Size
2.5MB
-
MD5
b7a4f8f906be5614f88762077f47b125
-
SHA1
e4c07a029e2fd5b899576b9ab1aa2035fc37bdaa
-
SHA256
142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c
-
SHA512
09d204701f42883419aa48ddb916a0f2637da3d7192ed6529e22651ca996f24663ee8167e8b659d83bfa9cfc9e821e3ab41c25426a07850ec354c58b062f01da
-
SSDEEP
49152:fxUUFD9hexlqxR7cqjilsIDXwwFYdCpob+Cyd88ILOlPDLCVkYI0Jy1:fxzD9hexlqxhIlVYwQwquaG0y1
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1504 4120 WerFault.exe rundll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
rundll32.exepid process 4120 rundll32.exe 4120 rundll32.exe 4120 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1640 wrote to memory of 4120 1640 rundll32.exe rundll32.exe PID 1640 wrote to memory of 4120 1640 rundll32.exe rundll32.exe PID 1640 wrote to memory of 4120 1640 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\142ac4d096c772d07284d31a1661c0211fc10bff3f79aa36955e61a1b2d0d51c.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:4120 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 8083⤵
- Program crash
PID:1504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4120 -ip 41201⤵PID:4912
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4120-133-0x0000000002C50000-0x00000000032C9000-memory.dmpFilesize
6.5MB
-
memory/4120-134-0x0000000002C50000-0x00000000032C9000-memory.dmpFilesize
6.5MB
-
memory/4120-135-0x0000000002C50000-0x00000000032C9000-memory.dmpFilesize
6.5MB
-
memory/4120-136-0x0000000002C50000-0x00000000032C9000-memory.dmpFilesize
6.5MB
-
memory/4120-137-0x0000000003480000-0x00000000035C0000-memory.dmpFilesize
1.2MB
-
memory/4120-138-0x0000000003480000-0x00000000035C0000-memory.dmpFilesize
1.2MB
-
memory/4120-139-0x0000000003480000-0x00000000035C0000-memory.dmpFilesize
1.2MB
-
memory/4120-141-0x0000000002C50000-0x00000000032C9000-memory.dmpFilesize
6.5MB
-
memory/4120-142-0x0000000003480000-0x00000000035C0000-memory.dmpFilesize
1.2MB
-
memory/4120-143-0x0000000003480000-0x00000000035C0000-memory.dmpFilesize
1.2MB
-
memory/4120-140-0x0000000003480000-0x00000000035C0000-memory.dmpFilesize
1.2MB
-
memory/4120-144-0x0000000002C50000-0x00000000032C9000-memory.dmpFilesize
6.5MB