Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 20:12
Behavioral task
behavioral1
Sample
31477ea57134ef7567c45716f2961389d25fb05a3eb0f0102e72c9856f697938.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
31477ea57134ef7567c45716f2961389d25fb05a3eb0f0102e72c9856f697938.dll
Resource
win10v2004-20240426-en
General
-
Target
31477ea57134ef7567c45716f2961389d25fb05a3eb0f0102e72c9856f697938.dll
-
Size
76KB
-
MD5
0813656e7d6da086bc983db865a51a89
-
SHA1
bafc60d71e8f86f00faecc4d91b2e90019f5bc68
-
SHA256
31477ea57134ef7567c45716f2961389d25fb05a3eb0f0102e72c9856f697938
-
SHA512
437ca8e89b82f7127e9717b685a6b09e2010c83d60c758418f86e78a98efe2b25d6eef4c22362f70379b7f4d8ccd066c6ad792989db5ebd2b62841b633681d18
-
SSDEEP
1536:BZZZZZZZZZZZZJOEDlwYSMQsGHxg0TS+XKzMqqU+2bbbAV2/S2TrKUM:zlZHQsozTS+MMqqDL2/TrK
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2300 2288 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2240 wrote to memory of 2288 2240 rundll32.exe rundll32.exe PID 2288 wrote to memory of 2300 2288 rundll32.exe WerFault.exe PID 2288 wrote to memory of 2300 2288 rundll32.exe WerFault.exe PID 2288 wrote to memory of 2300 2288 rundll32.exe WerFault.exe PID 2288 wrote to memory of 2300 2288 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31477ea57134ef7567c45716f2961389d25fb05a3eb0f0102e72c9856f697938.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\31477ea57134ef7567c45716f2961389d25fb05a3eb0f0102e72c9856f697938.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 2283⤵
- Program crash
PID:2300