Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 02:47
Behavioral task
behavioral1
Sample
2512bc611f3477627381e7b69fd3dfc0.dll
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2512bc611f3477627381e7b69fd3dfc0.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2512bc611f3477627381e7b69fd3dfc0.dll
-
Size
135KB
-
MD5
2512bc611f3477627381e7b69fd3dfc0
-
SHA1
4de71f730b57d672c3ccc9a655fd9e347b5462f9
-
SHA256
d1d3cf433e871d3aa6836ddb87578cbf494603f6f4a8918f36aea5816c6ce5e0
-
SHA512
ec71f2e14f38fd1aa8956ff38417cefbbebf35d2b79f70ac242f946cc7870a99c06329ee142a7fdc6c47e7ba27461065db38747eacf309b265d495c8e9b032f7
-
SSDEEP
3072:wh8W5EOvE8utrloMC0kfF1IZEZZ4QQ4h5UNrd:BWWOUtrlTSe+ZR8
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process 2800 2868 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2548 wrote to memory of 2868 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2868 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2868 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2868 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2868 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2868 2548 rundll32.exe rundll32.exe PID 2548 wrote to memory of 2868 2548 rundll32.exe rundll32.exe PID 2868 wrote to memory of 2800 2868 rundll32.exe WerFault.exe PID 2868 wrote to memory of 2800 2868 rundll32.exe WerFault.exe PID 2868 wrote to memory of 2800 2868 rundll32.exe WerFault.exe PID 2868 wrote to memory of 2800 2868 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2512bc611f3477627381e7b69fd3dfc0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2512bc611f3477627381e7b69fd3dfc0.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 2201⤵
- Program crash