Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
23/09/2023, 19:52
Behavioral task
behavioral1
Sample
2200-404-0x00000000035E0000-0x0000000003711000-memory.dll
Resource
win7-20230831-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2200-404-0x00000000035E0000-0x0000000003711000-memory.dll
Resource
win10v2004-20230915-en
0 signatures
150 seconds
General
-
Target
2200-404-0x00000000035E0000-0x0000000003711000-memory.dll
-
Size
1.2MB
-
MD5
5ad732a8a25db7c6695ee63aad725695
-
SHA1
4f46b43ad26b35f9170b59d856f070049471fa0b
-
SHA256
eea94b4d86d25c2938ff9e52832d78fb29fcc823a5ce754ce42f483ac69ccb48
-
SHA512
c0e49b311b14eee07c6f6b32829c7ceca4b1a578c704af0c8dd3e3c408c21bcfa4b55597b0bc80fd8c4c797b9fa90a1a44c1b649d692984776c740f3039f06b0
-
SSDEEP
24576:3C7CI9TZDEWk1wCy0zaG9cQAZ1ftxmbfYQJZKuBS:7I99DEWVtQAZZmn0u
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2072 wrote to memory of 1716 2072 rundll32.exe 28 PID 2072 wrote to memory of 1716 2072 rundll32.exe 28 PID 2072 wrote to memory of 1716 2072 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2200-404-0x00000000035E0000-0x0000000003711000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2072 -s 562⤵PID:1716
-