Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 15:11
Behavioral task
behavioral1
Sample
1228-55-0x00000000003A0000-0x00000000003DE000-memory.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1228-55-0x00000000003A0000-0x00000000003DE000-memory.dll
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
1228-55-0x00000000003A0000-0x00000000003DE000-memory.dll
-
Size
248KB
-
MD5
5cb9238dc77f60a232b6e5dd0e12806a
-
SHA1
2885bdfc9cdb318a18ced2fa8e475be95f54979c
-
SHA256
242d70d1d13856184bdd1ecac2dde90f4f215792d23d01045735cb6d569ede0e
-
SHA512
15819e4b1d94da95fd303c43f6568cbb1ec05dfab75de0e6643d2c1800964c1e793c05703e9a9a7a7ece73fef6a6e13f55d09978f6fbf346d0f4093a5c97dc60
-
SSDEEP
3072:lBNIVBXuQG3juybT8Cgzn/ZaAbo/V2tM7/WLcmLBjFUD5VcGj:luXuX3Pn8Cg/ZJbayMyLcm9j
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2020 3540 WerFault.exe 90 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1956 wrote to memory of 3540 1956 rundll32.exe 90 PID 1956 wrote to memory of 3540 1956 rundll32.exe 90 PID 1956 wrote to memory of 3540 1956 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1228-55-0x00000000003A0000-0x00000000003DE000-memory.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1228-55-0x00000000003A0000-0x00000000003DE000-memory.dll,#12⤵PID:3540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 5643⤵
- Program crash
PID:2020
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3540 -ip 35401⤵PID:3380