Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2023 07:22
Static task
static1
Behavioral task
behavioral1
Sample
5243fba8e663ca335f976f319261a4eb93ba409e0b184fbb3aa0dc56e6fca5d8.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5243fba8e663ca335f976f319261a4eb93ba409e0b184fbb3aa0dc56e6fca5d8.dll
Resource
win10v2004-20230915-en
General
-
Target
5243fba8e663ca335f976f319261a4eb93ba409e0b184fbb3aa0dc56e6fca5d8.dll
-
Size
2.1MB
-
MD5
39e27cb220a3b8953f71075b8ae3d6c8
-
SHA1
d3e1d194c6b5c253d716a3139106e6d0f1f03280
-
SHA256
5243fba8e663ca335f976f319261a4eb93ba409e0b184fbb3aa0dc56e6fca5d8
-
SHA512
35c9e2b9c7ad527f5da36c33b2e102412391604bea095802279a3bf31249c8e882e4ef2ae11dec11112162ba7cbcb30f957ab497e6970b06f9b2526a0cd3573f
-
SSDEEP
49152:vcz84B7m/mJoQAXJm/mEfZOkNPSTqctjRTDpJMMl:k7hm/eMcFPSTqsL5l
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1248 1212 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1212 1096 rundll32.exe 82 PID 1096 wrote to memory of 1212 1096 rundll32.exe 82 PID 1096 wrote to memory of 1212 1096 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5243fba8e663ca335f976f319261a4eb93ba409e0b184fbb3aa0dc56e6fca5d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5243fba8e663ca335f976f319261a4eb93ba409e0b184fbb3aa0dc56e6fca5d8.dll,#12⤵PID:1212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 5643⤵
- Program crash
PID:1248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1212 -ip 12121⤵PID:5064