Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 23:17
Behavioral task
behavioral1
Sample
71c62af59870564b311e61637616264171336dd48f63b8f0b4060650d0140571.dll
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
71c62af59870564b311e61637616264171336dd48f63b8f0b4060650d0140571.dll
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
71c62af59870564b311e61637616264171336dd48f63b8f0b4060650d0140571.dll
-
Size
117KB
-
MD5
f4ba8eb55cf6b532d6e9ae016e28840b
-
SHA1
48a6f0843e40776556fbc8edddc039f82a21f66e
-
SHA256
71c62af59870564b311e61637616264171336dd48f63b8f0b4060650d0140571
-
SHA512
371e08bdc361b1a2de6cd09d8fa77fdf83276d1c4d976e3d854dab0aa185ccbfeaa4912368900fd693f6f28cae7ab2cfdef3d60d80520d11632c0babe2dea43d
-
SSDEEP
3072:SQ7UKo8ztdcDu3FZ0/497Vafu6KRe++Z6R6q:SYUKoAtdcDu1iw3ghuerZJ
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1708 2008 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2844 wrote to memory of 2008 2844 rundll32.exe rundll32.exe PID 2844 wrote to memory of 2008 2844 rundll32.exe rundll32.exe PID 2844 wrote to memory of 2008 2844 rundll32.exe rundll32.exe PID 2844 wrote to memory of 2008 2844 rundll32.exe rundll32.exe PID 2844 wrote to memory of 2008 2844 rundll32.exe rundll32.exe PID 2844 wrote to memory of 2008 2844 rundll32.exe rundll32.exe PID 2844 wrote to memory of 2008 2844 rundll32.exe rundll32.exe PID 2008 wrote to memory of 1708 2008 rundll32.exe WerFault.exe PID 2008 wrote to memory of 1708 2008 rundll32.exe WerFault.exe PID 2008 wrote to memory of 1708 2008 rundll32.exe WerFault.exe PID 2008 wrote to memory of 1708 2008 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\71c62af59870564b311e61637616264171336dd48f63b8f0b4060650d0140571.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\71c62af59870564b311e61637616264171336dd48f63b8f0b4060650d0140571.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 2203⤵
- Program crash