Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2023, 22:52
Static task
static1
Behavioral task
behavioral1
Sample
7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d.dll
Resource
win10v2004-20230915-en
General
-
Target
7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d.dll
-
Size
2.1MB
-
MD5
19cdb0bf5a0f9e6f4f34b31323045ad2
-
SHA1
ae41f25c1b945ef8048dc8031242e4b1fd9373fb
-
SHA256
7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d
-
SHA512
4fe6a17eb3256e3d81c1b96311ad7ec006c5de598239beba4375862ee1908707524c3611c98637644d4c2610fb6303b56fc98fb3674697b4855237c80bfc33b3
-
SSDEEP
49152:vcz84B8m/mJtQAXJmWmEfZOkNPSTqctjRTDpJMMD8:k7qm/lMcQPSTqsL5D8
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2096 1800 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1452 wrote to memory of 1800 1452 rundll32.exe 82 PID 1452 wrote to memory of 1800 1452 rundll32.exe 82 PID 1452 wrote to memory of 1800 1452 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7273ce1dec7ed7e975207bd9472ef8b31a301b4901523e9dc4acc19bb86ee45d.dll,#12⤵PID:1800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 5603⤵
- Program crash
PID:2096
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1800 -ip 18001⤵PID:3804