Analysis
-
max time kernel
152s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 16:58
Static task
static1
Behavioral task
behavioral1
Sample
f5d0769cd32068a5d9cd294ea5a5cce8468c60be175dce4f244cb03dadb7f935.dll
Resource
win7-20221111-en
General
-
Target
f5d0769cd32068a5d9cd294ea5a5cce8468c60be175dce4f244cb03dadb7f935.dll
-
Size
296KB
-
MD5
46bbefdb05424020b343b499368743d6
-
SHA1
682ca231f2b9d0a548ec322b3340352745de5a67
-
SHA256
f5d0769cd32068a5d9cd294ea5a5cce8468c60be175dce4f244cb03dadb7f935
-
SHA512
7008720a9dd50ea17b77862efbed5549764b59fdc312e4d1f9eaadde2b8b613b962d56378bb43631541f4e0df0422f7b7b837785b4630726f7789c642e51bd15
-
SSDEEP
6144:pKZp3KNjVXvhy4K6GlhFIi/pt8bwr7Jkl6y7Z:pCxKNj9Q4K6Ghaihdq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32mgr.exepid process 2180 rundll32mgr.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32mgr.exepid process 2180 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3756 2180 WerFault.exe rundll32mgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2112 wrote to memory of 4104 2112 rundll32.exe rundll32.exe PID 2112 wrote to memory of 4104 2112 rundll32.exe rundll32.exe PID 2112 wrote to memory of 4104 2112 rundll32.exe rundll32.exe PID 4104 wrote to memory of 2180 4104 rundll32.exe rundll32mgr.exe PID 4104 wrote to memory of 2180 4104 rundll32.exe rundll32mgr.exe PID 4104 wrote to memory of 2180 4104 rundll32.exe rundll32mgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f5d0769cd32068a5d9cd294ea5a5cce8468c60be175dce4f244cb03dadb7f935.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f5d0769cd32068a5d9cd294ea5a5cce8468c60be175dce4f244cb03dadb7f935.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 4124⤵
- Program crash
PID:3756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2180 -ip 21801⤵PID:208
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
178KB
MD5db98a90a075816be151bf78a39293e5b
SHA18afc5325246accba5adcdd830aa4ff4b101e9983
SHA2560569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66
SHA5120793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e
-
Filesize
178KB
MD5db98a90a075816be151bf78a39293e5b
SHA18afc5325246accba5adcdd830aa4ff4b101e9983
SHA2560569be58ce08b5f17c84a3638327edf50aac1a2da68cee63c352f82545e61d66
SHA5120793d000ad8c151aa06df3e393fdf538faf93e70e479d5c2092ddebd6437a639db27fb8792669aa433a14f07e99b546fe1f36c1bb3a47b37127530bd5252451e