Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 01:14
Static task
static1
Behavioral task
behavioral1
Sample
a95379372b2d44439c4b210c8838688f7b5a3e6e1363ead44660b49f81d9ce72.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a95379372b2d44439c4b210c8838688f7b5a3e6e1363ead44660b49f81d9ce72.dll
Resource
win10v2004-20240412-en
General
-
Target
a95379372b2d44439c4b210c8838688f7b5a3e6e1363ead44660b49f81d9ce72.dll
-
Size
93KB
-
MD5
a9c0c1aa391048b5a88a577fc4436ece
-
SHA1
934e04428b11c2271c12d4d3474f4d4290d96acd
-
SHA256
a95379372b2d44439c4b210c8838688f7b5a3e6e1363ead44660b49f81d9ce72
-
SHA512
67133dbfdd40be41dc93c44e81be0dad0bcdfaeb9296217003bf6e1dac56240eccd7003ae602acecf11bb8ebdd64415a28a129ba10eb594485b1f88574e9b52f
-
SSDEEP
1536:8YoupQLr8gbr4PDkC1GHUjKzb7kP/cPceJrbwEO9xfNgz8sl8mckVPxIiTCOgp:Doj3A40G0jg7kP/cjJr0EO9xfNKNckVC
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1364 2616 WerFault.exe 86 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2616 rundll32.exe 2616 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 532 wrote to memory of 2616 532 rundll32.exe 86 PID 532 wrote to memory of 2616 532 rundll32.exe 86 PID 532 wrote to memory of 2616 532 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a95379372b2d44439c4b210c8838688f7b5a3e6e1363ead44660b49f81d9ce72.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a95379372b2d44439c4b210c8838688f7b5a3e6e1363ead44660b49f81d9ce72.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 6083⤵
- Program crash
PID:1364
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2616 -ip 26161⤵PID:2128