2b959bf862d9fbe941e979007f317ac1dba4f8af962aadfc2f1b451792784337

Analysis

max time kernel
28s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b959bf862d9fbe941e979007f317ac1dba4f8af962aadfc2f1b451792784337.dll
Size

308KB
MD5

00730544f0f9202fa7d10d9c4f21a360
SHA1

2178442bc2ac04b4256515085ee1aef420ddfac4
SHA256

2b959bf862d9fbe941e979007f317ac1dba4f8af962aadfc2f1b451792784337
SHA512

9f07237dc41f91cbf01de47a7c2869bdf3c49fe6267645c9a43f87d21cd69387dfad574a1cfdf3a3f94fcbe8f6730347a6f540fdc727e24a3707da160f34dad8
SSDEEP

6144:yriT2hMLaWJLmxR62jWkhnMvcUKL39AmcxOWlsuoi2vX:3LaYWRKklocUY32xbyzX

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1000	rundll32mgr.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-56.dat	upx
behavioral1/files/0x00140000000054ab-57.dat	upx
behavioral1/files/0x00140000000054ab-59.dat	upx
behavioral1/memory/1000-63-0x0000000000400000-0x0000000000480000-memory.dmp	upx

Loads dropped DLL 4 IoCs

pid	Process
1976	rundll32.exe
1976	rundll32.exe
1000	rundll32mgr.exe
1000	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2024	1000	WerFault.exe	29

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1792 wrote to memory of 1976	1792	rundll32.exe	28
PID 1976 wrote to memory of 1000	1976	rundll32.exe	29
PID 1976 wrote to memory of 1000	1976	rundll32.exe	29
PID 1976 wrote to memory of 1000	1976	rundll32.exe	29
PID 1976 wrote to memory of 1000	1976	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b959bf862d9fbe941e979007f317ac1dba4f8af962aadfc2f1b451792784337.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b959bf862d9fbe941e979007f317ac1dba4f8af962aadfc2f1b451792784337.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 204
      4⤵
      Program crash
      PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
184KB

MD5
9f1d413bad8c2ae51dae797bff0b471f

SHA1
1f284c735287387461666f30926afc3746609877

SHA256
ac914d391e854a0a7896944819fedb3eb2d1be4f34e3478abce2a4129a1f8845

SHA512
eaaa8499ce71d0f27912c2a194e62e9a9660602f9488503688d21fa9efc45a448a8e011c8bbb1feeca0b2fc25789362a2cc6069062e78e688abc0aa26e8b70c5

Download Submit
\Users\Admin\AppData\Local\Temp\~TM276F.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\~TM27FC.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
184KB

MD5
9f1d413bad8c2ae51dae797bff0b471f

SHA1
1f284c735287387461666f30926afc3746609877

SHA256
ac914d391e854a0a7896944819fedb3eb2d1be4f34e3478abce2a4129a1f8845

SHA512
eaaa8499ce71d0f27912c2a194e62e9a9660602f9488503688d21fa9efc45a448a8e011c8bbb1feeca0b2fc25789362a2cc6069062e78e688abc0aa26e8b70c5

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
184KB

MD5
9f1d413bad8c2ae51dae797bff0b471f

SHA1
1f284c735287387461666f30926afc3746609877

SHA256
ac914d391e854a0a7896944819fedb3eb2d1be4f34e3478abce2a4129a1f8845

SHA512
eaaa8499ce71d0f27912c2a194e62e9a9660602f9488503688d21fa9efc45a448a8e011c8bbb1feeca0b2fc25789362a2cc6069062e78e688abc0aa26e8b70c5

Download Submit
memory/1000-63-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1000-64-0x0000000077660000-0x00000000777E0000-memory.dmp

Filesize
1.5MB

Download
memory/1976-55-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/1976-65-0x0000000010000000-0x0000000010096000-memory.dmp

Filesize
600KB

Download
memory/1976-66-0x0000000000650000-0x00000000006D0000-memory.dmp

Filesize
512KB

Download
memory/1976-67-0x0000000000650000-0x00000000006D0000-memory.dmp

Filesize
512KB

Download
memory/1976-68-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download