Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 15:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6b0a9736d70daa74669891f58a2deafe8b3a36343beaf0fb6897d2c9104f014.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
General
-
Target
f6b0a9736d70daa74669891f58a2deafe8b3a36343beaf0fb6897d2c9104f014.dll
-
Size
657KB
-
MD5
8e8d8673bf21d21126de1a51a8f3b143
-
SHA1
0a74598cfd848eff16c2d107742407998bc541a7
-
SHA256
f6b0a9736d70daa74669891f58a2deafe8b3a36343beaf0fb6897d2c9104f014
-
SHA512
f6d49510d43a7c8d05cd419eb81f1a5fdae7ccdab7acaf41ce7be2db3e34123af8f344062c4c4f725977246f6cc248e1f98f43142a65a20ae5629bf288284d69
-
SSDEEP
12288:ivFwcQPvsHzdyqebglJ5svnpQfMQrQQRdf9javC+/7cQWnrsIZxL3DmsOQ6XGT6:0FwfPuYbA5zkQrFRuI1TVDfT6
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2188 2840 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2464 wrote to memory of 2840 2464 rundll32.exe rundll32.exe PID 2464 wrote to memory of 2840 2464 rundll32.exe rundll32.exe PID 2464 wrote to memory of 2840 2464 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f6b0a9736d70daa74669891f58a2deafe8b3a36343beaf0fb6897d2c9104f014.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f6b0a9736d70daa74669891f58a2deafe8b3a36343beaf0fb6897d2c9104f014.dll,#12⤵PID:2840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 6243⤵
- Program crash
PID:2188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2840 -ip 28401⤵PID:4080