Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 09:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14b28a43785254415ce74667a2fb30ab.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
14b28a43785254415ce74667a2fb30ab.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
14b28a43785254415ce74667a2fb30ab.dll
-
Size
29KB
-
MD5
14b28a43785254415ce74667a2fb30ab
-
SHA1
2179fc5120136ebec55242a004054d470dc38bbe
-
SHA256
276f469b7e1675b442223b64660257ea84ee15d276868015ec12b49e64ec86da
-
SHA512
d4f724fae72d726da902a8e3c8ab8267dc9a23c90c3a21fc780c3df2961cebcb77697402ef38317bb7d7172aadadf791bdde51a3ba92e360d4484d8acf76d886
-
SSDEEP
768:4UhOBrTv6uPaeVbvci/8f+kUVw7DRriyrfdSM:49V5aeVb0i/8GRw7brFSM
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1860 1080 WerFault.exe 54 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 544 wrote to memory of 1080 544 rundll32.exe 54 PID 544 wrote to memory of 1080 544 rundll32.exe 54 PID 544 wrote to memory of 1080 544 rundll32.exe 54
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\14b28a43785254415ce74667a2fb30ab.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\14b28a43785254415ce74667a2fb30ab.dll,#12⤵PID:1080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 5803⤵
- Program crash
PID:1860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1080 -ip 10801⤵PID:1624