Analysis
-
max time kernel
133s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 02:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64397a12b65a8d892059b130489530c5.dll
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
64397a12b65a8d892059b130489530c5.dll
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
64397a12b65a8d892059b130489530c5.dll
-
Size
28KB
-
MD5
64397a12b65a8d892059b130489530c5
-
SHA1
b52de7210845bdc5e8bf9c7894fe85c99032204d
-
SHA256
70246fc1a99c0d35c5f5377f400c18c571bfbadc30248c303605e492547a492e
-
SHA512
6bcb56761703e10e4fd93510611aa05d43aa0c218eb7a24667cfd5b5598600625f01ce2308290f255e264afe8d1826e771d261be9a80373894046c248844daeb
-
SSDEEP
768:sXk2iRlvzkBfv75w+LumkqTrg89f232hpZeGc:/RtzkjPuBq/VDpw
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4656 2000 WerFault.exe 20 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4564 wrote to memory of 2000 4564 rundll32.exe 20 PID 4564 wrote to memory of 2000 4564 rundll32.exe 20 PID 4564 wrote to memory of 2000 4564 rundll32.exe 20
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64397a12b65a8d892059b130489530c5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64397a12b65a8d892059b130489530c5.dll,#12⤵PID:2000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 5523⤵
- Program crash
PID:4656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2000 -ip 20001⤵PID:1208