Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 00:26
Behavioral task
behavioral1
Sample
561f43e2cfc237d05feb40f3ac63d238907d26fe096a2ba24c3fb997a5360fa9.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
561f43e2cfc237d05feb40f3ac63d238907d26fe096a2ba24c3fb997a5360fa9.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
561f43e2cfc237d05feb40f3ac63d238907d26fe096a2ba24c3fb997a5360fa9.dll
-
Size
206KB
-
MD5
75432486fe8fa1ab00064cf9350509d6
-
SHA1
a333ba2525748311d88856fb9ff61e424bcc14e3
-
SHA256
561f43e2cfc237d05feb40f3ac63d238907d26fe096a2ba24c3fb997a5360fa9
-
SHA512
76c5229435e9fbc30696e2e1047c8ca39bc56bb8f34c37e585f4002be901957548011dc37b6878d670166b35ba3b71a3e7611eb2dfcc714cf19b0def8c6920e9
-
SSDEEP
3072:ZnT2RRXuwcN3OQXB8CITr9VV2ILe126JyTuBdjdUa5Rlj:ZwXupN1x8CgBbRLDTuLj
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2092 2196 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1932 wrote to memory of 2196 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2196 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2196 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2196 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2196 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2196 1932 rundll32.exe rundll32.exe PID 1932 wrote to memory of 2196 1932 rundll32.exe rundll32.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe WerFault.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe WerFault.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe WerFault.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\561f43e2cfc237d05feb40f3ac63d238907d26fe096a2ba24c3fb997a5360fa9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\561f43e2cfc237d05feb40f3ac63d238907d26fe096a2ba24c3fb997a5360fa9.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 2283⤵
- Program crash