8d395b42850b5491949047d0800c22666e378bd3590f9740dcfcbd2a4b161794

Analysis

max time kernel
136s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d395b42850b5491949047d0800c22666e378bd3590f9740dcfcbd2a4b161794.dll
Size

696KB
MD5

3b0a0d3c7ae4ff73067e40596af89f70
SHA1

1b2b1b8db3297e0dd50ceb74470fb50a34684cc2
SHA256

8d395b42850b5491949047d0800c22666e378bd3590f9740dcfcbd2a4b161794
SHA512

09cbf0d3af93ad681f139092abf97bc7da77026f8334bbe712cc0d9441e9af2c1d9122cf03e93ee0c62eb345fa97293846cdce3bd49383ed5346bb0646537711
SSDEEP

12288:XehnaNPpSVZmNxRCwnwm3W3OHIIf5Ut/LbZ/QHBtSY12wpUYUMPik/w:Xeh0PpS6NxNnwYeOHXeZ/Z/EBtlprakI

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
624	rundll32mgr.exe
2476	rundll32mgrmgr.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe
File created	C:\Windows\SysWOW64\rundll32mgrmgr.exe	rundll32mgr.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4456	624	WerFault.exe	85
3420	2476	WerFault.exe	86
396	2160	WerFault.exe	84

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2160	2108	rundll32.exe	84
PID 2108 wrote to memory of 2160	2108	rundll32.exe	84
PID 2108 wrote to memory of 2160	2108	rundll32.exe	84
PID 2160 wrote to memory of 624	2160	rundll32.exe	85
PID 2160 wrote to memory of 624	2160	rundll32.exe	85
PID 2160 wrote to memory of 624	2160	rundll32.exe	85
PID 624 wrote to memory of 2476	624	rundll32mgr.exe	86
PID 624 wrote to memory of 2476	624	rundll32mgr.exe	86
PID 624 wrote to memory of 2476	624	rundll32mgr.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d395b42850b5491949047d0800c22666e378bd3590f9740dcfcbd2a4b161794.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d395b42850b5491949047d0800c22666e378bd3590f9740dcfcbd2a4b161794.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2160
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\SysWOW64\rundll32mgrmgr.exe
      C:\Windows\SysWOW64\rundll32mgrmgr.exe
      4⤵
      Executes dropped EXE
      PID:2476
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 300
        5⤵
        Program crash
        
        PID:3420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 624 -s 276
      4⤵
      Program crash
      PID:4456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 632
    3⤵
    - Program crash
    PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 2160 -ip 2160
1⤵
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 624 -ip 624
1⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2476 -ip 2476
1⤵
PID:2068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
309KB

MD5
d524c613d28ab5264acf742d746914e9

SHA1
c36f7b3b28549bbc611f9cfa33a365ed966d8137

SHA256
c378f8ffe12a93b2f217f78b2e0b86c2a766290f95ea3ffc9b7248103e91ca7a

SHA512
ddc6da5952d14413aaa04e9ae3b9fb49acb18818db67f6b71cd7942d3e52a6eeda9e1b7c910484ce55885b871163fbeea4d254c9d9ad63efe2ecbb526c833064

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
309KB

MD5
d524c613d28ab5264acf742d746914e9

SHA1
c36f7b3b28549bbc611f9cfa33a365ed966d8137

SHA256
c378f8ffe12a93b2f217f78b2e0b86c2a766290f95ea3ffc9b7248103e91ca7a

SHA512
ddc6da5952d14413aaa04e9ae3b9fb49acb18818db67f6b71cd7942d3e52a6eeda9e1b7c910484ce55885b871163fbeea4d254c9d9ad63efe2ecbb526c833064

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
153KB

MD5
b5f135ec53a36d2eeefd6b4461ec2920

SHA1
0f90f0fb7978d6c9f9412ef5940306b710f570dd

SHA256
9249722e370b4171b3506e2acb5215b7be98fc95ea797aeb47da945d6f128902

SHA512
5efbc1c46f7d3799097db91d67221e15c5fa74d3a5eba43759457438b24960378d1515c0427a4e89c6a1a8fa073b9905869c2a99559d3f7f7613e25533eb46e6

Download Submit
C:\Windows\SysWOW64\rundll32mgrmgr.exe

Filesize
153KB

MD5
b5f135ec53a36d2eeefd6b4461ec2920

SHA1
0f90f0fb7978d6c9f9412ef5940306b710f570dd

SHA256
9249722e370b4171b3506e2acb5215b7be98fc95ea797aeb47da945d6f128902

SHA512
5efbc1c46f7d3799097db91d67221e15c5fa74d3a5eba43759457438b24960378d1515c0427a4e89c6a1a8fa073b9905869c2a99559d3f7f7613e25533eb46e6

Download Submit
memory/624-140-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/624-142-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2160-139-0x0000000010000000-0x00000000100B0000-memory.dmp

Filesize
704KB

Download
memory/2476-141-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2476-143-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads