Analysis
-
max time kernel
71s -
max time network
75s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
12-07-2023 04:54
Behavioral task
behavioral1
Sample
2872-54-0x000007FEF56B0000-0x000007FEF5C3F000-memory.dll
Resource
win7-20230703-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2872-54-0x000007FEF56B0000-0x000007FEF5C3F000-memory.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
2872-54-0x000007FEF56B0000-0x000007FEF5C3F000-memory.dll
-
Size
5.6MB
-
MD5
018b05ec0f91aa4c29011e8342a6415c
-
SHA1
1bf09bea0bce1a0ce426d53008770ec0efcbf67e
-
SHA256
3ee86c04b4f72c8fa314dede0958cca899b96f019d2f67ab6f7145e1a0de5ece
-
SHA512
ebc8d62736b3dce09e5555725c997d800e59966c0169b061f6abbd955279bfe17f7845846a0f7f8b13d0ca22341501e9180763a48167cce705266f6045ffbd15
-
SSDEEP
98304:F4Uckey5/2vrfnQyuNYyGQEn8c2JTNV7ziZ+tsrwWlTc1ij3421hnpZMvS:iUbROjQfWQEp2VNQMeVc1O3uvS
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2364 2064 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2064 wrote to memory of 2364 2064 rundll32.exe WerFault.exe PID 2064 wrote to memory of 2364 2064 rundll32.exe WerFault.exe PID 2064 wrote to memory of 2364 2064 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2872-54-0x000007FEF56B0000-0x000007FEF5C3F000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2064 -s 562⤵
- Program crash
PID:2364