Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
04-10-2023 08:14
Behavioral task
behavioral1
Sample
2912-368-0x00000000035C0000-0x00000000036F1000-memory.dll
Resource
win7-20230831-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2912-368-0x00000000035C0000-0x00000000036F1000-memory.dll
Resource
win10v2004-20230915-en
0 signatures
150 seconds
General
-
Target
2912-368-0x00000000035C0000-0x00000000036F1000-memory.dll
-
Size
1.2MB
-
MD5
d54553fbc7e93ec8b9028a6b66b8a8a3
-
SHA1
92cf70b96d6e4be9e3554b97f09c5e9ab075b6d0
-
SHA256
855bb755acf09ff3c4f20013649aef8597528d310a273798bab4c5e84ab5bd12
-
SHA512
91b75acf5d7d18106cffdfee9a050305976beba2ed7b44954bfcd4ea990cfd6350fd3402a3ed6babc81ae1ecdfba99249f7683da087a9a608d12c34c3bc85948
-
SSDEEP
24576:3C7CI9TZDEWk1wCy0zaG9cQAr1ftxmbfYQJZKJng:7I99DEWVtQArZmn0R
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1940 1740 rundll32.exe 28 PID 1740 wrote to memory of 1940 1740 rundll32.exe 28 PID 1740 wrote to memory of 1940 1740 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2912-368-0x00000000035C0000-0x00000000036F1000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1740 -s 562⤵PID:1940
-