Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TaaprWareV3.dll
Resource
win7-20240508-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
TaaprWareV3.dll
Resource
win10v2004-20240426-en
10 signatures
150 seconds
General
-
Target
TaaprWareV3.dll
-
Size
242KB
-
MD5
a6dd063fecdba990085d9ee1492519c8
-
SHA1
ca3ad5f5bdd9c48ef5a7e35ec27ab5d88e25da38
-
SHA256
00a4789705818e4c8b87d4804d975bf2aee5a4779ad2055c5a5f8fb9bbac1321
-
SHA512
f758dc12feaca2ca9db49d652eb7d4f2626569414479281c65c99cc5eb06ae8e203a5526128a3e3050c961c42cf0d7108ac11fc3cf3b45012c8657bb8b994966
-
SSDEEP
3072:5AMpM3f+eXt4x7uwrAicOAUGRmM5c6B3rgFLKa6OEFF255zz5CSMw8mL8N:5AUSwr+jUGsM26ZsFLKa6UpCSM
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2792 2992 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2992 2460 rundll32.exe 28 PID 2460 wrote to memory of 2992 2460 rundll32.exe 28 PID 2460 wrote to memory of 2992 2460 rundll32.exe 28 PID 2460 wrote to memory of 2992 2460 rundll32.exe 28 PID 2460 wrote to memory of 2992 2460 rundll32.exe 28 PID 2460 wrote to memory of 2992 2460 rundll32.exe 28 PID 2460 wrote to memory of 2992 2460 rundll32.exe 28 PID 2992 wrote to memory of 2792 2992 rundll32.exe 30 PID 2992 wrote to memory of 2792 2992 rundll32.exe 30 PID 2992 wrote to memory of 2792 2992 rundll32.exe 30 PID 2992 wrote to memory of 2792 2992 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TaaprWareV3.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TaaprWareV3.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 2923⤵
- Program crash
PID:2792
-
-