5a50d092f812660e56a71bfb07dc1ee801e8b7f137a436c8853b75ab43dbb1cd

General

Target

5a50d092f812660e56a71bfb07dc1ee801e8b7f137a436c8853b75ab43dbb1cd.dll
Size

452KB
MD5

6fa51471fc073a42fd3726c8809505a2
SHA1

8fae90ae9561b3ccfea50f465e4ae8709371f271
SHA256

5a50d092f812660e56a71bfb07dc1ee801e8b7f137a436c8853b75ab43dbb1cd
SHA512

700b20f79e73e384d367e6d7b0af89da3f98a93c8834b0e0c7cff73963195c2a3e141a0c2fc95591f3baea8941fcd4b7b21643ad391a09932dcfc100516e94a7
SSDEEP

12288:MlVvN1QWguohInJDrn8zwNF7eCr1jyN27pIow:u2Sxrn80NF771jy070

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
112	rundll32mgr.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/112-66-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1076	rundll32.exe
1076	rundll32.exe
112	rundll32mgr.exe
112	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1644	1076	WerFault.exe	26
1820	112	WerFault.exe	27

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1488 wrote to memory of 1076	1488	rundll32.exe	26
PID 1076 wrote to memory of 112	1076	rundll32.exe	27
PID 1076 wrote to memory of 112	1076	rundll32.exe	27
PID 1076 wrote to memory of 112	1076	rundll32.exe	27
PID 1076 wrote to memory of 112	1076	rundll32.exe	27
PID 1076 wrote to memory of 1644	1076	rundll32.exe	28
PID 1076 wrote to memory of 1644	1076	rundll32.exe	28
PID 1076 wrote to memory of 1644	1076	rundll32.exe	28
PID 1076 wrote to memory of 1644	1076	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a50d092f812660e56a71bfb07dc1ee801e8b7f137a436c8853b75ab43dbb1cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5a50d092f812660e56a71bfb07dc1ee801e8b7f137a436c8853b75ab43dbb1cd.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:112
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 180
      4⤵
      Program crash
      PID:1820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 228
    3⤵
    - Program crash
    PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
106KB

MD5
bcf377e2eda50d577b1215da4dd4f2fe

SHA1
198ac4da4b587c5c2769c6727bd8574fc87ea71e

SHA256
58978ff9757977b7f4b67506f93c650f6cda9c270dcc2609421aeeaae72f96e1

SHA512
7bad3dbaf60d64dabf25a5edc8b230e6cd4533079285aa75b12a52eaf92cf9c8d9ac5ed318e9e498cd2409be4deff2b8d898844c8ee5fcef610322b9adf47a83

Download Submit
\Users\Admin\AppData\Local\Temp\~TM4A4A.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM4B06.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
106KB

MD5
bcf377e2eda50d577b1215da4dd4f2fe

SHA1
198ac4da4b587c5c2769c6727bd8574fc87ea71e

SHA256
58978ff9757977b7f4b67506f93c650f6cda9c270dcc2609421aeeaae72f96e1

SHA512
7bad3dbaf60d64dabf25a5edc8b230e6cd4533079285aa75b12a52eaf92cf9c8d9ac5ed318e9e498cd2409be4deff2b8d898844c8ee5fcef610322b9adf47a83

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
106KB

MD5
bcf377e2eda50d577b1215da4dd4f2fe

SHA1
198ac4da4b587c5c2769c6727bd8574fc87ea71e

SHA256
58978ff9757977b7f4b67506f93c650f6cda9c270dcc2609421aeeaae72f96e1

SHA512
7bad3dbaf60d64dabf25a5edc8b230e6cd4533079285aa75b12a52eaf92cf9c8d9ac5ed318e9e498cd2409be4deff2b8d898844c8ee5fcef610322b9adf47a83

Download Submit
memory/112-68-0x0000000077BF0000-0x0000000077D70000-memory.dmp

Filesize
1.5MB

Download
memory/112-67-0x0000000000220000-0x000000000024A000-memory.dmp

Filesize
168KB

Download
memory/112-66-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1076-58-0x0000000000130000-0x000000000015A000-memory.dmp

Filesize
168KB

Download
memory/1076-57-0x000000007C360000-0x000000007C3D2000-memory.dmp

Filesize
456KB

Download
memory/1076-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1076-69-0x0000000000130000-0x000000000015A000-memory.dmp

Filesize
168KB

Download
memory/1076-70-0x000000007C360000-0x000000007C3D2000-memory.dmp

Filesize
456KB

Download

Analysis

Sharing