33857e703b65a87ecefb4624607b8b28a47d96540d641dd29ad20a3e7ca81d5f

Analysis

max time kernel
142s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33857e703b65a87ecefb4624607b8b28a47d96540d641dd29ad20a3e7ca81d5f.dll
Size

96KB
MD5

0a4566c77cbd26c01b34d1d7e6637ff0
SHA1

77a3a44c23d1767c130cd39d722ef0a592dd6857
SHA256

33857e703b65a87ecefb4624607b8b28a47d96540d641dd29ad20a3e7ca81d5f
SHA512

380635ef75177339b72bd1dee46925c1edd165ae6ab5f4889151638cf49ab0bc9084967044211b23d93ed83fbc86466951fe4e948f3f29e8f2353ccd970d0375
SSDEEP

3072:qD/1QkfFFFnHLidQXdoTfnUC6l/lJCCwRzlGDF7Gq7:qDSQXd8fnp6l/L7wRzm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1932	rundll32mgr.exe

Loads dropped DLL 9 IoCs

pid	Process
840	rundll32.exe
840	rundll32.exe
988	WerFault.exe
988	WerFault.exe
988	WerFault.exe
988	WerFault.exe
988	WerFault.exe
988	WerFault.exe
988	WerFault.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
988	1932	WerFault.exe	27
948	840	WerFault.exe	26

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 1376 wrote to memory of 840	1376	rundll32.exe	26
PID 840 wrote to memory of 1932	840	rundll32.exe	27
PID 840 wrote to memory of 1932	840	rundll32.exe	27
PID 840 wrote to memory of 1932	840	rundll32.exe	27
PID 840 wrote to memory of 1932	840	rundll32.exe	27
PID 1932 wrote to memory of 988	1932	rundll32mgr.exe	28
PID 1932 wrote to memory of 988	1932	rundll32mgr.exe	28
PID 1932 wrote to memory of 988	1932	rundll32mgr.exe	28
PID 1932 wrote to memory of 988	1932	rundll32mgr.exe	28
PID 840 wrote to memory of 948	840	rundll32.exe	29
PID 840 wrote to memory of 948	840	rundll32.exe	29
PID 840 wrote to memory of 948	840	rundll32.exe	29
PID 840 wrote to memory of 948	840	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33857e703b65a87ecefb4624607b8b28a47d96540d641dd29ad20a3e7ca81d5f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33857e703b65a87ecefb4624607b8b28a47d96540d641dd29ad20a3e7ca81d5f.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 92
      4⤵
      Loads dropped DLL
      Program crash
      PID:988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 224
    3⤵
    - Program crash
    PID:948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
54KB

MD5
fba9053e3a7f286a68a072f5d1b57b42

SHA1
19c4800e8de1e83ff7bf0b96a96563e8430ce9f3

SHA256
5675295a26c3839803fd25fb667f2be09c2b6bf3412202a09c3dfc9a46eb4ca4

SHA512
ee53bbd9531801df780279da49bd34863513db67fbacbd6b0abb844d02cb76f5e86ed39ad28585b27aa42d3659a8fc9f3d1459f92f81eca970e69bac7c403c64

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
54KB

MD5
fba9053e3a7f286a68a072f5d1b57b42

SHA1
19c4800e8de1e83ff7bf0b96a96563e8430ce9f3

SHA256
5675295a26c3839803fd25fb667f2be09c2b6bf3412202a09c3dfc9a46eb4ca4

SHA512
ee53bbd9531801df780279da49bd34863513db67fbacbd6b0abb844d02cb76f5e86ed39ad28585b27aa42d3659a8fc9f3d1459f92f81eca970e69bac7c403c64

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
54KB

MD5
fba9053e3a7f286a68a072f5d1b57b42

SHA1
19c4800e8de1e83ff7bf0b96a96563e8430ce9f3

SHA256
5675295a26c3839803fd25fb667f2be09c2b6bf3412202a09c3dfc9a46eb4ca4

SHA512
ee53bbd9531801df780279da49bd34863513db67fbacbd6b0abb844d02cb76f5e86ed39ad28585b27aa42d3659a8fc9f3d1459f92f81eca970e69bac7c403c64

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
54KB

MD5
fba9053e3a7f286a68a072f5d1b57b42

SHA1
19c4800e8de1e83ff7bf0b96a96563e8430ce9f3

SHA256
5675295a26c3839803fd25fb667f2be09c2b6bf3412202a09c3dfc9a46eb4ca4

SHA512
ee53bbd9531801df780279da49bd34863513db67fbacbd6b0abb844d02cb76f5e86ed39ad28585b27aa42d3659a8fc9f3d1459f92f81eca970e69bac7c403c64

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
54KB

MD5
fba9053e3a7f286a68a072f5d1b57b42

SHA1
19c4800e8de1e83ff7bf0b96a96563e8430ce9f3

SHA256
5675295a26c3839803fd25fb667f2be09c2b6bf3412202a09c3dfc9a46eb4ca4

SHA512
ee53bbd9531801df780279da49bd34863513db67fbacbd6b0abb844d02cb76f5e86ed39ad28585b27aa42d3659a8fc9f3d1459f92f81eca970e69bac7c403c64

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
54KB

MD5
fba9053e3a7f286a68a072f5d1b57b42

SHA1
19c4800e8de1e83ff7bf0b96a96563e8430ce9f3

SHA256
5675295a26c3839803fd25fb667f2be09c2b6bf3412202a09c3dfc9a46eb4ca4

SHA512
ee53bbd9531801df780279da49bd34863513db67fbacbd6b0abb844d02cb76f5e86ed39ad28585b27aa42d3659a8fc9f3d1459f92f81eca970e69bac7c403c64

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
54KB

MD5
fba9053e3a7f286a68a072f5d1b57b42

SHA1
19c4800e8de1e83ff7bf0b96a96563e8430ce9f3

SHA256
5675295a26c3839803fd25fb667f2be09c2b6bf3412202a09c3dfc9a46eb4ca4

SHA512
ee53bbd9531801df780279da49bd34863513db67fbacbd6b0abb844d02cb76f5e86ed39ad28585b27aa42d3659a8fc9f3d1459f92f81eca970e69bac7c403c64

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
54KB

MD5
fba9053e3a7f286a68a072f5d1b57b42

SHA1
19c4800e8de1e83ff7bf0b96a96563e8430ce9f3

SHA256
5675295a26c3839803fd25fb667f2be09c2b6bf3412202a09c3dfc9a46eb4ca4

SHA512
ee53bbd9531801df780279da49bd34863513db67fbacbd6b0abb844d02cb76f5e86ed39ad28585b27aa42d3659a8fc9f3d1459f92f81eca970e69bac7c403c64

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
54KB

MD5
fba9053e3a7f286a68a072f5d1b57b42

SHA1
19c4800e8de1e83ff7bf0b96a96563e8430ce9f3

SHA256
5675295a26c3839803fd25fb667f2be09c2b6bf3412202a09c3dfc9a46eb4ca4

SHA512
ee53bbd9531801df780279da49bd34863513db67fbacbd6b0abb844d02cb76f5e86ed39ad28585b27aa42d3659a8fc9f3d1459f92f81eca970e69bac7c403c64

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
54KB

MD5
fba9053e3a7f286a68a072f5d1b57b42

SHA1
19c4800e8de1e83ff7bf0b96a96563e8430ce9f3

SHA256
5675295a26c3839803fd25fb667f2be09c2b6bf3412202a09c3dfc9a46eb4ca4

SHA512
ee53bbd9531801df780279da49bd34863513db67fbacbd6b0abb844d02cb76f5e86ed39ad28585b27aa42d3659a8fc9f3d1459f92f81eca970e69bac7c403c64

Download Submit
memory/840-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/840-69-0x0000000074CD0000-0x0000000074CEC000-memory.dmp

Filesize
112KB

Download
memory/840-70-0x0000000074CB0000-0x0000000074CCC000-memory.dmp

Filesize
112KB

Download
memory/840-71-0x0000000074CD0000-0x0000000074CEC000-memory.dmp

Filesize
112KB

Download
memory/840-72-0x0000000074CD0000-0x0000000074CEC000-memory.dmp

Filesize
112KB

Download
memory/840-73-0x0000000074CD0000-0x0000000074CEC000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads