Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 02:47
Behavioral task
behavioral1
Sample
2512bc611f3477627381e7b69fd3dfc0.dll
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2512bc611f3477627381e7b69fd3dfc0.dll
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2512bc611f3477627381e7b69fd3dfc0.dll
-
Size
135KB
-
MD5
2512bc611f3477627381e7b69fd3dfc0
-
SHA1
4de71f730b57d672c3ccc9a655fd9e347b5462f9
-
SHA256
d1d3cf433e871d3aa6836ddb87578cbf494603f6f4a8918f36aea5816c6ce5e0
-
SHA512
ec71f2e14f38fd1aa8956ff38417cefbbebf35d2b79f70ac242f946cc7870a99c06329ee142a7fdc6c47e7ba27461065db38747eacf309b265d495c8e9b032f7
-
SSDEEP
3072:wh8W5EOvE8utrloMC0kfF1IZEZZ4QQ4h5UNrd:BWWOUtrlTSe+ZR8
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4804 2564 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4500 wrote to memory of 2564 4500 rundll32.exe rundll32.exe PID 4500 wrote to memory of 2564 4500 rundll32.exe rundll32.exe PID 4500 wrote to memory of 2564 4500 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2512bc611f3477627381e7b69fd3dfc0.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2512bc611f3477627381e7b69fd3dfc0.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 6043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2564 -ip 25641⤵