Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
04-12-2023 08:18
Behavioral task
behavioral1
Sample
2e0d819a664dc1682ae860ac0bc24a827722fb0d782d15d32c4acce7cfedfcc5.dll
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
2e0d819a664dc1682ae860ac0bc24a827722fb0d782d15d32c4acce7cfedfcc5.dll
Resource
win10v2004-20231130-en
General
-
Target
2e0d819a664dc1682ae860ac0bc24a827722fb0d782d15d32c4acce7cfedfcc5.dll
-
Size
56KB
-
MD5
1c747e00d3ec0920c3d07e06de761e64
-
SHA1
e89861d554ae39e238f23112c242d5334db2e6cb
-
SHA256
2e0d819a664dc1682ae860ac0bc24a827722fb0d782d15d32c4acce7cfedfcc5
-
SHA512
510957a0f6927309fd9fe4315138e09bcdd5e1f14bd6129746cace62ac19f5b6360113c7938b6b85093065976b48d543968f5782bc21b2c20bcbd13aa399e271
-
SSDEEP
768:A21n5lRGhic4Z1KvY2FyZWjlC/gL8MNF7yNcYNzB1BA5V53vrUZKmdbhrknZ:35lCic4Z1DUAsw/gfBWD1ybm1hiZ
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2336 1896 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2308 wrote to memory of 1896 2308 rundll32.exe rundll32.exe PID 2308 wrote to memory of 1896 2308 rundll32.exe rundll32.exe PID 2308 wrote to memory of 1896 2308 rundll32.exe rundll32.exe PID 2308 wrote to memory of 1896 2308 rundll32.exe rundll32.exe PID 2308 wrote to memory of 1896 2308 rundll32.exe rundll32.exe PID 2308 wrote to memory of 1896 2308 rundll32.exe rundll32.exe PID 2308 wrote to memory of 1896 2308 rundll32.exe rundll32.exe PID 1896 wrote to memory of 2336 1896 rundll32.exe WerFault.exe PID 1896 wrote to memory of 2336 1896 rundll32.exe WerFault.exe PID 1896 wrote to memory of 2336 1896 rundll32.exe WerFault.exe PID 1896 wrote to memory of 2336 1896 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e0d819a664dc1682ae860ac0bc24a827722fb0d782d15d32c4acce7cfedfcc5.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2e0d819a664dc1682ae860ac0bc24a827722fb0d782d15d32c4acce7cfedfcc5.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 1923⤵
- Program crash