Analysis
-
max time kernel
11s -
max time network
2s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2022 09:12
Static task
static1
Behavioral task
behavioral1
Sample
RasTls.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
RasTls.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
RasTls.dll.res
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
RasTls.dll.res
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
RasTls.exe
Resource
win7-20220901-en
General
-
Target
RasTls.dll
-
Size
3KB
-
MD5
d5915394a6916a00c426aa2827d97c0e
-
SHA1
50064d66c9b55b6f7d22051b81914d8366fe36c8
-
SHA256
6cd5079a69d9a68029e37f2680f44b7ba71c2b1eecf4894c2a8b293d5f768f10
-
SHA512
56aa607a5a1bf095b017fd23a1007795f4bdd3a5a5efe571f7c74b7a4e37fb88f3031c26b5189e9f67328222b3dda621a7379da5341bfa95e25605b703ea6373
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1928 1564 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1152 wrote to memory of 1564 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1564 1152 rundll32.exe rundll32.exe PID 1152 wrote to memory of 1564 1152 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\RasTls.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\RasTls.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 8483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1564 -ip 15641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1564-132-0x0000000000000000-mapping.dmp