Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 21:17
Behavioral task
behavioral1
Sample
9e3b921e57f9434d9f9490ed0c4a10d915c327178405c1eaba2f1888bfaf0eb2.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9e3b921e57f9434d9f9490ed0c4a10d915c327178405c1eaba2f1888bfaf0eb2.dll
Resource
win10v2004-20240226-en
General
-
Target
9e3b921e57f9434d9f9490ed0c4a10d915c327178405c1eaba2f1888bfaf0eb2.dll
-
Size
205KB
-
MD5
070d79c9e99273c98ba075c846ce1061
-
SHA1
cb90a5ade6d948fe1009513fe35a26752d3fb55d
-
SHA256
9e3b921e57f9434d9f9490ed0c4a10d915c327178405c1eaba2f1888bfaf0eb2
-
SHA512
2ec6a51ff06340025aba00622237ba18f10c094a2d49c4b6c043379281fbdeda39460795c61dafe6512a346a932366920dfb90e74bbcd408384b4faf30dd2e87
-
SSDEEP
3072:v/QPFX1eqEfuBNSYuiM8CNj8hFsoMX0ghsJRgCD3iFw9jdUL5Xb:v/MEfuN0t8C5oFsoeRM3o0jY
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2372 760 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1736 wrote to memory of 760 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 760 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 760 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 760 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 760 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 760 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 760 1736 rundll32.exe rundll32.exe PID 760 wrote to memory of 2372 760 rundll32.exe WerFault.exe PID 760 wrote to memory of 2372 760 rundll32.exe WerFault.exe PID 760 wrote to memory of 2372 760 rundll32.exe WerFault.exe PID 760 wrote to memory of 2372 760 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e3b921e57f9434d9f9490ed0c4a10d915c327178405c1eaba2f1888bfaf0eb2.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e3b921e57f9434d9f9490ed0c4a10d915c327178405c1eaba2f1888bfaf0eb2.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 2283⤵
- Program crash