40ae5686af1d386286a4087e18640a47e9a1406f724207c1988c8d118b4be384 | Triage

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-07-2022 15:13

Sharing

Report Analysis Logs

General

Target

12ykgyy/xldl.dll
Size

286KB
MD5

40e8d381da7c2badc4b6f0cdb4b5378f
SHA1

3646338c6a20f17bf4383a8d053ce37681df8ead
SHA256

cb0b0c42dae0a1e946f97f6bda522eb5ad943cb632ba3d19f597ecb3e1f5eb94
SHA512

68dc5128d2e90885ca0e69dced80254e87ab765faefaf152b3cf452b37fb730ec146d4930342ced3f227bd7622a93592526d73567155346de14cd76e5180e7b3

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1940 1684 WerFault.exe rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1648 wrote to memory of 1684	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1684	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1684	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1684	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1684	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1684	1648	rundll32.exe	rundll32.exe
PID 1648 wrote to memory of 1684	1648	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 1940	1684	rundll32.exe	WerFault.exe
PID 1684 wrote to memory of 1940	1684	rundll32.exe	WerFault.exe
PID 1684 wrote to memory of 1940	1684	rundll32.exe	WerFault.exe
PID 1684 wrote to memory of 1940	1684	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12ykgyy\xldl.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\12ykgyy\xldl.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 236
3⤵
- Program crash
PID:1940

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-54-0x0000000000000000-mapping.dmp

Download
memory/1684-55-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download
memory/1940-56-0x0000000000000000-mapping.dmp

Download