dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b

Analysis

max time kernel
144s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b.dll
Size

228KB
MD5

821a30f218c9859df50ad9cedebe7c20
SHA1

c4cc3a351a90f84a8620c8b72996e5f53f4368cb
SHA256

dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b
SHA512

479dd141586f4ecc368cc7b8ba29d76b00fa5124ba3f5e517cc44910cd0bd3012209b2f57a4eae59094eb723b4046f0f84a56ab747bcd090d2371d4ea662c9e1
SSDEEP

3072:00NbrbkYHUyP9eECVWfpIhbWoVnW6IioARoKO7JurNeBTg4vRP86T9OB/nDN02Zg:nrkYHjIWeWcd7MRMnfn0e5BGCeR

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1616	rundll32mgr.exe

Loads dropped DLL 9 IoCs

pid	Process
1400	rundll32.exe
1400	rundll32.exe
1496	WerFault.exe
1496	WerFault.exe
1496	WerFault.exe
1496	WerFault.exe
1496	WerFault.exe
1496	WerFault.exe
1496	WerFault.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1220	1400	WerFault.exe	28
1496	1616	WerFault.exe	29

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1400	1948	rundll32.exe	28
PID 1948 wrote to memory of 1400	1948	rundll32.exe	28
PID 1948 wrote to memory of 1400	1948	rundll32.exe	28
PID 1948 wrote to memory of 1400	1948	rundll32.exe	28
PID 1948 wrote to memory of 1400	1948	rundll32.exe	28
PID 1948 wrote to memory of 1400	1948	rundll32.exe	28
PID 1948 wrote to memory of 1400	1948	rundll32.exe	28
PID 1400 wrote to memory of 1616	1400	rundll32.exe	29
PID 1400 wrote to memory of 1616	1400	rundll32.exe	29
PID 1400 wrote to memory of 1616	1400	rundll32.exe	29
PID 1400 wrote to memory of 1616	1400	rundll32.exe	29
PID 1400 wrote to memory of 1220	1400	rundll32.exe	30
PID 1400 wrote to memory of 1220	1400	rundll32.exe	30
PID 1400 wrote to memory of 1220	1400	rundll32.exe	30
PID 1400 wrote to memory of 1220	1400	rundll32.exe	30
PID 1616 wrote to memory of 1496	1616	rundll32mgr.exe	31
PID 1616 wrote to memory of 1496	1616	rundll32mgr.exe	31
PID 1616 wrote to memory of 1496	1616	rundll32mgr.exe	31
PID 1616 wrote to memory of 1496	1616	rundll32mgr.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dca875517a91dc40d1b7c9f2c87de83f122cbda80c14611f69a7e9b02d7f704b.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 100
      4⤵
      Loads dropped DLL
      Program crash
      PID:1496
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 224
    3⤵
    - Program crash
    PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
60KB

MD5
94f2f6ffbba8e7644668b51b39983916

SHA1
63357bbdf90101969117983dbc0d4ed0e713c4d7

SHA256
ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed

SHA512
d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156

Download Submit
memory/1400-61-0x0000000074830000-0x000000007486E000-memory.dmp

Filesize
248KB

Download
memory/1400-60-0x0000000074870000-0x00000000748AE000-memory.dmp

Filesize
248KB

Download
memory/1400-55-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1400-71-0x0000000074830000-0x000000007486E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads