Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
7e0d0f77fe1dcb1e7a0a0a2fc0c25a68eee551c7045935449ae64dcbd1310958 (1).dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7e0d0f77fe1dcb1e7a0a0a2fc0c25a68eee551c7045935449ae64dcbd1310958 (1).dll
Resource
win10v2004-20240226-en
General
-
Target
7e0d0f77fe1dcb1e7a0a0a2fc0c25a68eee551c7045935449ae64dcbd1310958 (1).dll
-
Size
570KB
-
MD5
4a231b7fe78a606307a038ca3140a19b
-
SHA1
5cf5a440c67a3c7e265bad6f01f486c1a02813de
-
SHA256
7e0d0f77fe1dcb1e7a0a0a2fc0c25a68eee551c7045935449ae64dcbd1310958
-
SHA512
d7d71b9268d2cc3051c16766d5e5a8c835e4c4c27fec7056f7331e8664caf4bd32348e027e4aed68c578f7d2cd843427b21d155f042438528b69fba9fda749ff
-
SSDEEP
12288:0qgXafAGMEnhyYl0ZY0UlaZ4w2H4YkKldf/nGHaBCVUyWvmW:0VEnMxGC4wY4YkKLGHaBSUyWvmW
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3572 2324 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 548 wrote to memory of 2324 548 rundll32.exe 89 PID 548 wrote to memory of 2324 548 rundll32.exe 89 PID 548 wrote to memory of 2324 548 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\7e0d0f77fe1dcb1e7a0a0a2fc0c25a68eee551c7045935449ae64dcbd1310958 (1).dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\7e0d0f77fe1dcb1e7a0a0a2fc0c25a68eee551c7045935449ae64dcbd1310958 (1).dll",#12⤵PID:2324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 6403⤵
- Program crash
PID:3572
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2324 -ip 23241⤵PID:1572