Analysis
-
max time kernel
140s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 18:45
Static task
static1
Behavioral task
behavioral1
Sample
1e5320df4ab3e41237c252a9fc4743c1fbb81efe582795d247d0bb0f60eecb29.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1e5320df4ab3e41237c252a9fc4743c1fbb81efe582795d247d0bb0f60eecb29.dll
Resource
win10v2004-20230915-en
General
-
Target
1e5320df4ab3e41237c252a9fc4743c1fbb81efe582795d247d0bb0f60eecb29.dll
-
Size
2.3MB
-
MD5
824afe6ac9f82f6a988a5afe956437f8
-
SHA1
c0fbbf32fea979780398a45d0644356545f87f7b
-
SHA256
1e5320df4ab3e41237c252a9fc4743c1fbb81efe582795d247d0bb0f60eecb29
-
SHA512
6623823f45061fd54b1b6e0e0535362a965f7777eec48f4ca289474751d31ac5416439efe1a23d66b091f1e2b1ce78ec5219fec2cde8c923c5b9ce643c7183aa
-
SSDEEP
49152:w3LfBK3JEFgLKi+idrhiGjTBVk+oIMG9vYUaZ5:w7B/eLKipEGCUaZ5
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4964 2364 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2364 2472 rundll32.exe 83 PID 2472 wrote to memory of 2364 2472 rundll32.exe 83 PID 2472 wrote to memory of 2364 2472 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1e5320df4ab3e41237c252a9fc4743c1fbb81efe582795d247d0bb0f60eecb29.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1e5320df4ab3e41237c252a9fc4743c1fbb81efe582795d247d0bb0f60eecb29.dll,#12⤵PID:2364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 6323⤵
- Program crash
PID:4964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2364 -ip 23641⤵PID:3064