d85fc0e45cc705cc7052e05fe23b2ed7a18dc13de509ad49509e090465b01230

Analysis

Target
temp.tmp.dll
Size 130KB
Sample200827-j4gty8ppvs
SHA256 d85fc0e45cc705cc7052e05fe23b2ed7a18dc13de509ad49509e090465b01230
MD5 909d4faaa4cd504c55b374410603d682
SHA1 f386f28b3f7496457f233a76c6f91026e2ffc9f0
SHA512 8decab67dacd7d6d191b5b647459a3ac436e7b263c098ad7438557d9e3297b02f6253b029962a77c50c7423a4ac80c295149ce323850ebbc1e070e5dc9e54b76
MD5 SHA1 SHA512

Score

9^/10

ServiceHost packer 3 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/904-2-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/904-3-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/904-4-0x0000000000000000-mapping.dmp	servicehost

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3940	904	WerFault.exe	68

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 260861fcc77cd601	svchost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1004	svchost.exe
Token: SeCreatePagefilePrivilege	1004	svchost.exe
Token: SeRestorePrivilege	3940	WerFault.exe
Token: SeBackupPrivilege	3940	WerFault.exe
Token: SeDebugPrivilege	3940	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 904	508	rundll32.exe	68
PID 508 wrote to memory of 904	508	rundll32.exe	68
PID 508 wrote to memory of 904	508	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\temp.tmp.dll,#1
  2⤵
  PID:904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 632
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3940

memory/3940-1-0x00000000044C0000-0x00000000044C1000-memory.dmp

Download