Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 13:27
Behavioral task
behavioral1
Sample
2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll
Resource
win7-20230831-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll
Resource
win10v2004-20230915-en
2 signatures
150 seconds
General
-
Target
2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll
-
Size
56KB
-
MD5
1cf21c0bbe89e58e75d77ef2b0444247
-
SHA1
23745fd565cc616a3ebf7ac4044f201ac834bd9c
-
SHA256
e1daf460c47bd7d01c1a2761cbe8b522277e23aa33c31452ba7d89ffa0d1f3d2
-
SHA512
b5b237bc1c7eee9f0d77c10bd7ddf074855af81c63454b197728536a19996876a29493b0186ce2cbfb5daef4ed7e27be6b52dabb7425d5d7891810c6eb3b93fa
-
SSDEEP
768:A2kXSxZFHCUaQ+73M3yvx0ya8Kl7aQixYgxYJmv0NHY7lbjNltdX20JJ:eCxZ8UaQ+73M3dBVJaf3C7YJj3HG0JJ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4116 220 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3496 wrote to memory of 220 3496 rundll32.exe rundll32.exe PID 3496 wrote to memory of 220 3496 rundll32.exe rundll32.exe PID 3496 wrote to memory of 220 3496 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2920-1-0x00000000001B0000-0x00000000001BE000-memory.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 5603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 220 -ip 2201⤵