bdb39f248d0cd06c086b5e38a8120fa4feb9208a4236f32b23e601a4037be416 | Triage

Resubmissions

21-08-2023 15:40

230821-s39vqadh37 10

11-08-2023 19:23

230811-x36khsac6w 10

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
11-08-2023 19:23

Sharing

Report Analysis Logs

General

Target

Predictor V6.3/api-ms-win-crt-heap-l1-1-0.dll
Size

19KB
MD5

f9e20dd3b07766307fccf463ab26e3ca
SHA1

60b4cf246c5f414fc1cd12f506c41a1043d473ee
SHA256

af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a
SHA512

13c43eee9c93c9f252087cb397ff2d6b087b1dc92a47ba5493297f080e91b7c39ee5665d6bdc1a80e7320e2b085541fc798a3469b1f249b05dee26bbbb6ab706
SSDEEP

384:0Y3eBW1hWeXRm0GftpBjI6xIm3S006lD16hU:EQzVi66xI+

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2624 2596 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2596 wrote to memory of 2624	2596	rundll32.exe	WerFault.exe
PID 2596 wrote to memory of 2624	2596	rundll32.exe	WerFault.exe
PID 2596 wrote to memory of 2624	2596	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Predictor V6.3\api-ms-win-crt-heap-l1-1-0.dll",#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2596 -s 84
2⤵
- Program crash
PID:2624

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...