Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 15:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13a6b9b0cb511df243abcac34539e4c8465826e1fa012e13d0fe67476c9191d8.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
General
-
Target
13a6b9b0cb511df243abcac34539e4c8465826e1fa012e13d0fe67476c9191d8.dll
-
Size
600KB
-
MD5
e73164847311387bfc9fa722f264b2dc
-
SHA1
01aab93797b4b329adf4be9548f9e7e0802c998b
-
SHA256
13a6b9b0cb511df243abcac34539e4c8465826e1fa012e13d0fe67476c9191d8
-
SHA512
e0a80c015f3834885bcf0f4892dc489ab67e0c9772d0bf387d042bff63e3d3639cd0674db7b8451cbe1a26d53cb5668a93b8f77ddb20b5da71ec24cab5964fcf
-
SSDEEP
12288:aLVYmb+rC++14fIJ4n9eK+RSQoVzb73P4cKGZ13DaxuD+BxjJJRUbTNwHPe7lG:IYq+rC++14wyn9eK+8QoVzb73P4cKGjI
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2320 2676 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1628 wrote to memory of 2676 1628 rundll32.exe rundll32.exe PID 1628 wrote to memory of 2676 1628 rundll32.exe rundll32.exe PID 1628 wrote to memory of 2676 1628 rundll32.exe rundll32.exe PID 1628 wrote to memory of 2676 1628 rundll32.exe rundll32.exe PID 1628 wrote to memory of 2676 1628 rundll32.exe rundll32.exe PID 1628 wrote to memory of 2676 1628 rundll32.exe rundll32.exe PID 1628 wrote to memory of 2676 1628 rundll32.exe rundll32.exe PID 2676 wrote to memory of 2320 2676 rundll32.exe WerFault.exe PID 2676 wrote to memory of 2320 2676 rundll32.exe WerFault.exe PID 2676 wrote to memory of 2320 2676 rundll32.exe WerFault.exe PID 2676 wrote to memory of 2320 2676 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\13a6b9b0cb511df243abcac34539e4c8465826e1fa012e13d0fe67476c9191d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\13a6b9b0cb511df243abcac34539e4c8465826e1fa012e13d0fe67476c9191d8.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 2243⤵
- Program crash
PID:2320