8a005b30a4aba7b10a1146826a189d8ec240316464b5b45cdaed56272608bbc5

General

Target

8a005b30a4aba7b10a1146826a189d8ec240316464b5b45cdaed56272608bbc5.dll
Size

244KB
MD5

75e6c5f90d12885e6ae103440f4ee500
SHA1

342cb45b2f28644c4029ae297450f28a684eadb3
SHA256

8a005b30a4aba7b10a1146826a189d8ec240316464b5b45cdaed56272608bbc5
SHA512

02225b2db94982671c5bd75ae7481d5e335f8e6e84dcb73c6b9bc2deb46f11e77548184ff3065ac58b48f01cefe9f8b36ef66491d7e81829e57b90f3e446f992
SSDEEP

3072:iHJ3uezIH4TwDnbU+VPBNiz2130BSuqPeBZuIvv2nxy4B0hw+Dc2c2C:tU4HHpB1jcZbvenxybG+pc2C

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
792	rundll32mgr.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-56.dat	upx
behavioral1/files/0x00140000000054ab-59.dat	upx
behavioral1/files/0x00140000000054ab-57.dat	upx
behavioral1/memory/792-65-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-69.dat	upx
behavioral1/files/0x00140000000054ab-68.dat	upx
behavioral1/files/0x00140000000054ab-67.dat	upx
behavioral1/files/0x00140000000054ab-70.dat	upx

Loads dropped DLL 6 IoCs

pid	Process
1628	rundll32.exe
1628	rundll32.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe
1444	WerFault.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1444	792	WerFault.exe	28
1252	1628	WerFault.exe	27

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1724 wrote to memory of 1628	1724	rundll32.exe	27
PID 1628 wrote to memory of 792	1628	rundll32.exe	28
PID 1628 wrote to memory of 792	1628	rundll32.exe	28
PID 1628 wrote to memory of 792	1628	rundll32.exe	28
PID 1628 wrote to memory of 792	1628	rundll32.exe	28
PID 792 wrote to memory of 1444	792	rundll32mgr.exe	29
PID 792 wrote to memory of 1444	792	rundll32mgr.exe	29
PID 792 wrote to memory of 1444	792	rundll32mgr.exe	29
PID 792 wrote to memory of 1444	792	rundll32mgr.exe	29
PID 1628 wrote to memory of 1252	1628	rundll32.exe	30
PID 1628 wrote to memory of 1252	1628	rundll32.exe	30
PID 1628 wrote to memory of 1252	1628	rundll32.exe	30
PID 1628 wrote to memory of 1252	1628	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a005b30a4aba7b10a1146826a189d8ec240316464b5b45cdaed56272608bbc5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8a005b30a4aba7b10a1146826a189d8ec240316464b5b45cdaed56272608bbc5.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 792 -s 48
      4⤵
      Loads dropped DLL
      Program crash
      PID:1444
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 224
    3⤵
    - Program crash
    PID:1252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
177KB

MD5
3057899a0737ff16ec205af279774bc3

SHA1
d845fc786a80680215fc7fdbaf359d0f6208ecb2

SHA256
ca004129badd533f7f0ec63e96dbead81b675da7794ce6ebb35cfa11c1f5de23

SHA512
4588c3c1229f02e542ccefab17b6a87fd7b6f1f516ab8643211f83502ec7e620d58c73de97dca11178b8c1a897be8c3497611655c7bb6d007fc545f050bd412d

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
177KB

MD5
3057899a0737ff16ec205af279774bc3

SHA1
d845fc786a80680215fc7fdbaf359d0f6208ecb2

SHA256
ca004129badd533f7f0ec63e96dbead81b675da7794ce6ebb35cfa11c1f5de23

SHA512
4588c3c1229f02e542ccefab17b6a87fd7b6f1f516ab8643211f83502ec7e620d58c73de97dca11178b8c1a897be8c3497611655c7bb6d007fc545f050bd412d

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
177KB

MD5
3057899a0737ff16ec205af279774bc3

SHA1
d845fc786a80680215fc7fdbaf359d0f6208ecb2

SHA256
ca004129badd533f7f0ec63e96dbead81b675da7794ce6ebb35cfa11c1f5de23

SHA512
4588c3c1229f02e542ccefab17b6a87fd7b6f1f516ab8643211f83502ec7e620d58c73de97dca11178b8c1a897be8c3497611655c7bb6d007fc545f050bd412d

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
177KB

MD5
3057899a0737ff16ec205af279774bc3

SHA1
d845fc786a80680215fc7fdbaf359d0f6208ecb2

SHA256
ca004129badd533f7f0ec63e96dbead81b675da7794ce6ebb35cfa11c1f5de23

SHA512
4588c3c1229f02e542ccefab17b6a87fd7b6f1f516ab8643211f83502ec7e620d58c73de97dca11178b8c1a897be8c3497611655c7bb6d007fc545f050bd412d

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
177KB

MD5
3057899a0737ff16ec205af279774bc3

SHA1
d845fc786a80680215fc7fdbaf359d0f6208ecb2

SHA256
ca004129badd533f7f0ec63e96dbead81b675da7794ce6ebb35cfa11c1f5de23

SHA512
4588c3c1229f02e542ccefab17b6a87fd7b6f1f516ab8643211f83502ec7e620d58c73de97dca11178b8c1a897be8c3497611655c7bb6d007fc545f050bd412d

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
177KB

MD5
3057899a0737ff16ec205af279774bc3

SHA1
d845fc786a80680215fc7fdbaf359d0f6208ecb2

SHA256
ca004129badd533f7f0ec63e96dbead81b675da7794ce6ebb35cfa11c1f5de23

SHA512
4588c3c1229f02e542ccefab17b6a87fd7b6f1f516ab8643211f83502ec7e620d58c73de97dca11178b8c1a897be8c3497611655c7bb6d007fc545f050bd412d

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
177KB

MD5
3057899a0737ff16ec205af279774bc3

SHA1
d845fc786a80680215fc7fdbaf359d0f6208ecb2

SHA256
ca004129badd533f7f0ec63e96dbead81b675da7794ce6ebb35cfa11c1f5de23

SHA512
4588c3c1229f02e542ccefab17b6a87fd7b6f1f516ab8643211f83502ec7e620d58c73de97dca11178b8c1a897be8c3497611655c7bb6d007fc545f050bd412d

Download Submit
memory/792-65-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1628-64-0x0000000000290000-0x00000000002F6000-memory.dmp

Filesize
408KB

Download
memory/1628-63-0x0000000074540000-0x0000000074582000-memory.dmp

Filesize
264KB

Download
memory/1628-62-0x00000000744F0000-0x0000000074532000-memory.dmp

Filesize
264KB

Download
memory/1628-60-0x0000000074540000-0x0000000074582000-memory.dmp

Filesize
264KB

Download
memory/1628-55-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/1628-71-0x0000000074540000-0x0000000074582000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing