Analysis
-
max time kernel
186s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 11:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17777257ed494cf0ea75b869a535c8f5.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
17777257ed494cf0ea75b869a535c8f5.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
17777257ed494cf0ea75b869a535c8f5.dll
-
Size
156KB
-
MD5
17777257ed494cf0ea75b869a535c8f5
-
SHA1
ad22bd07b4766ff67f05f01dd65c0d128a060781
-
SHA256
982be5e56dbd500dfb243fc9ca205be48bae1b492975b5bce2a96e09cd46d546
-
SHA512
7d7842030e05cff5d3810f8240b24b9a83a9a0aa7c8ccf30a3859c7171b418b43adfe1e542f444b6704122caad8fa8a860d575e20a47afc92bd3c1536ff13d96
-
SSDEEP
1536:vLMydMlWpt1Sd7iyt7QXLi7EN5Tv2fb87BK04wu5mk90wp48DinMrLQJ6AV0:vLMyW77iytsXLi76iNbZ1iMrLt7
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1008 3168 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1616 wrote to memory of 3168 1616 rundll32.exe 89 PID 1616 wrote to memory of 3168 1616 rundll32.exe 89 PID 1616 wrote to memory of 3168 1616 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\17777257ed494cf0ea75b869a535c8f5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\17777257ed494cf0ea75b869a535c8f5.dll,#12⤵PID:3168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 5443⤵
- Program crash
PID:1008
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3168 -ip 31681⤵PID:1004