f2b3499121baba009f05137bca2ffaf7ad4d582621f36febf563c55974718dd6

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2b3499121baba009f05137bca2ffaf7ad4d582621f36febf563c55974718dd6.dll
Size

260KB
MD5

96c79ea51c2beae60aa1e4881f3bd824
SHA1

47db43984d893fbcf363ce6a66ea94986925777e
SHA256

f2b3499121baba009f05137bca2ffaf7ad4d582621f36febf563c55974718dd6
SHA512

2aab23a13fc6bc791610e71c6f28ed262fe56de749d77e2d10f1d2bfededb061a4ed7b47cd7cae08053e43e30a6ceaae7e253d2a6c5b4330e28fcc03b654c3d1
SSDEEP

3072:sZmu9K33WSwdJ/tILtAPrL+oxdv9jD4Nn0LhlchQAItUkkH0jpgj7xIhVH/g:s8b33QqUrSqc0LDchQptQieVI//g

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1940	rundll32mgr.exe

Loads dropped DLL 9 IoCs

pid	Process
1684	rundll32.exe
1684	rundll32.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	1940	WerFault.exe	28

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1684	1988	rundll32.exe	27
PID 1988 wrote to memory of 1684	1988	rundll32.exe	27
PID 1988 wrote to memory of 1684	1988	rundll32.exe	27
PID 1988 wrote to memory of 1684	1988	rundll32.exe	27
PID 1988 wrote to memory of 1684	1988	rundll32.exe	27
PID 1988 wrote to memory of 1684	1988	rundll32.exe	27
PID 1988 wrote to memory of 1684	1988	rundll32.exe	27
PID 1684 wrote to memory of 1940	1684	rundll32.exe	28
PID 1684 wrote to memory of 1940	1684	rundll32.exe	28
PID 1684 wrote to memory of 1940	1684	rundll32.exe	28
PID 1684 wrote to memory of 1940	1684	rundll32.exe	28
PID 1940 wrote to memory of 1972	1940	rundll32mgr.exe	29
PID 1940 wrote to memory of 1972	1940	rundll32mgr.exe	29
PID 1940 wrote to memory of 1972	1940	rundll32mgr.exe	29
PID 1940 wrote to memory of 1972	1940	rundll32mgr.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2b3499121baba009f05137bca2ffaf7ad4d582621f36febf563c55974718dd6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f2b3499121baba009f05137bca2ffaf7ad4d582621f36febf563c55974718dd6.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 100
      4⤵
      Loads dropped DLL
      Program crash
      PID:1972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
memory/1684-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1940-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads