Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 15:11
Behavioral task
behavioral1
Sample
1228-55-0x00000000003A0000-0x00000000003DE000-memory.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1228-55-0x00000000003A0000-0x00000000003DE000-memory.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
1228-55-0x00000000003A0000-0x00000000003DE000-memory.dll
-
Size
248KB
-
MD5
5cb9238dc77f60a232b6e5dd0e12806a
-
SHA1
2885bdfc9cdb318a18ced2fa8e475be95f54979c
-
SHA256
242d70d1d13856184bdd1ecac2dde90f4f215792d23d01045735cb6d569ede0e
-
SHA512
15819e4b1d94da95fd303c43f6568cbb1ec05dfab75de0e6643d2c1800964c1e793c05703e9a9a7a7ece73fef6a6e13f55d09978f6fbf346d0f4093a5c97dc60
-
SSDEEP
3072:lBNIVBXuQG3juybT8Cgzn/ZaAbo/V2tM7/WLcmLBjFUD5VcGj:luXuX3Pn8Cg/ZJbayMyLcm9j
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2980 2972 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2972 2904 rundll32.exe 28 PID 2904 wrote to memory of 2972 2904 rundll32.exe 28 PID 2904 wrote to memory of 2972 2904 rundll32.exe 28 PID 2904 wrote to memory of 2972 2904 rundll32.exe 28 PID 2904 wrote to memory of 2972 2904 rundll32.exe 28 PID 2904 wrote to memory of 2972 2904 rundll32.exe 28 PID 2904 wrote to memory of 2972 2904 rundll32.exe 28 PID 2972 wrote to memory of 2980 2972 rundll32.exe 29 PID 2972 wrote to memory of 2980 2972 rundll32.exe 29 PID 2972 wrote to memory of 2980 2972 rundll32.exe 29 PID 2972 wrote to memory of 2980 2972 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1228-55-0x00000000003A0000-0x00000000003DE000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1228-55-0x00000000003A0000-0x00000000003DE000-memory.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 1923⤵
- Program crash
PID:2980
-
-