Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 09:36
Static task
static1
Behavioral task
behavioral1
Sample
6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809.dll
Resource
win10v2004-20240226-en
General
-
Target
6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809.dll
-
Size
2.0MB
-
MD5
9553923ac77dd68b7d94b57a1ccb829f
-
SHA1
8a4f3877977ed9b9abc98e31a29d89e896ae3dc1
-
SHA256
6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809
-
SHA512
cc8eeaea1f7f16cf586d0480e506951de807f3949eb92a915e27935c02ef09755b98ba155ae71e38866e3e4f9670ddc1b83ac368bfce7bff6c2c47b3ef145458
-
SSDEEP
49152:SpW2WCN9mIFOKjQ5TwkonUr1q7NWcPjH3hPbC5GMhE:SpW2WCDmIFOh5Tw+q7NWsXh
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 2072 4440 WerFault.exe 91 3700 4440 WerFault.exe 91 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3484 wrote to memory of 4440 3484 rundll32.exe 91 PID 3484 wrote to memory of 4440 3484 rundll32.exe 91 PID 3484 wrote to memory of 4440 3484 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6ae8fc4a47782efb68c435abfe29c1962e6b6273e6d3f289dce7ecdf84017809.dll,#12⤵PID:4440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 6203⤵
- Program crash
PID:2072
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 7923⤵
- Program crash
PID:3700
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4440 -ip 44401⤵PID:1960
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4440 -ip 44401⤵PID:4048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:1132