2c58b5f29c9b9ad9638cc55b66d0c4503eaa3ef9b6c786182d939d99fefb8d40

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c58b5f29c9b9ad9638cc55b66d0c4503eaa3ef9b6c786182d939d99fefb8d40.dll
Size

123KB
MD5

4504aadb29c0e296ca92ed44db78e014
SHA1

0acc2e46bd1b7be7c3b88702fd46c01aa285946d
SHA256

2c58b5f29c9b9ad9638cc55b66d0c4503eaa3ef9b6c786182d939d99fefb8d40
SHA512

54d13dde80db82fe76c4af36171c8b4b6589cd5037a5335aa78ea8fb5235cab254d7c5682e96b3d23b0afe71ebb8d3e84cdff29e875e2bc516678c735019044b
SSDEEP

3072:CuevieaLqpG59j6kb9K5Yrwj7rfNmtOSL6+3XxCh:CuEivDqD5Yrc8OSL73Xxs

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

rundll32mgr.exe

pid process

936 rundll32mgr.exe

pid	process
936	rundll32mgr.exe

Loads dropped DLL 9 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
1692	rundll32.exe
1692	rundll32.exe
1020	WerFault.exe
1020	WerFault.exe
1020	WerFault.exe
1020	WerFault.exe
1020	WerFault.exe
1020	WerFault.exe
1020	WerFault.exe

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1020 936 WerFault.exe rundll32mgr.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

pid	pid_target	process	target process
1020	936	WerFault.exe	rundll32mgr.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exe

description	pid	process	target process
PID 1900 wrote to memory of 1692	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1692	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1692	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1692	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1692	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1692	1900	rundll32.exe	rundll32.exe
PID 1900 wrote to memory of 1692	1900	rundll32.exe	rundll32.exe
PID 1692 wrote to memory of 936	1692	rundll32.exe	rundll32mgr.exe
PID 1692 wrote to memory of 936	1692	rundll32.exe	rundll32mgr.exe
PID 1692 wrote to memory of 936	1692	rundll32.exe	rundll32mgr.exe
PID 1692 wrote to memory of 936	1692	rundll32.exe	rundll32mgr.exe
PID 936 wrote to memory of 1020	936	rundll32mgr.exe	WerFault.exe
PID 936 wrote to memory of 1020	936	rundll32mgr.exe	WerFault.exe
PID 936 wrote to memory of 1020	936	rundll32mgr.exe	WerFault.exe
PID 936 wrote to memory of 1020	936	rundll32mgr.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c58b5f29c9b9ad9638cc55b66d0c4503eaa3ef9b6c786182d939d99fefb8d40.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c58b5f29c9b9ad9638cc55b66d0c4503eaa3ef9b6c786182d939d99fefb8d40.dll,#1
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\rundll32mgr.exe
C:\Windows\SysWOW64\rundll32mgr.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 92
4⤵
- Loads dropped DLL
- Program crash
PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
aea1462e5f1f31dd74df7833b5a07305

SHA1
cea53b9b3311f1003df5d9266f9e3fbd5c971f28

SHA256
62c957db467d22cf12af74a4dae478e7d239ecae5d53f3c6399583f38f5224af

SHA512
776eeffb068df67e852191f5ec869df6e4cb6c4f14dbe8748cf6b3f9aad2f3b09baa7c61285cb5a5f1253b5bd9525470a25ca77fbe2d26ed02ae7d955142970e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
aea1462e5f1f31dd74df7833b5a07305

SHA1
cea53b9b3311f1003df5d9266f9e3fbd5c971f28

SHA256
62c957db467d22cf12af74a4dae478e7d239ecae5d53f3c6399583f38f5224af

SHA512
776eeffb068df67e852191f5ec869df6e4cb6c4f14dbe8748cf6b3f9aad2f3b09baa7c61285cb5a5f1253b5bd9525470a25ca77fbe2d26ed02ae7d955142970e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
aea1462e5f1f31dd74df7833b5a07305

SHA1
cea53b9b3311f1003df5d9266f9e3fbd5c971f28

SHA256
62c957db467d22cf12af74a4dae478e7d239ecae5d53f3c6399583f38f5224af

SHA512
776eeffb068df67e852191f5ec869df6e4cb6c4f14dbe8748cf6b3f9aad2f3b09baa7c61285cb5a5f1253b5bd9525470a25ca77fbe2d26ed02ae7d955142970e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
aea1462e5f1f31dd74df7833b5a07305

SHA1
cea53b9b3311f1003df5d9266f9e3fbd5c971f28

SHA256
62c957db467d22cf12af74a4dae478e7d239ecae5d53f3c6399583f38f5224af

SHA512
776eeffb068df67e852191f5ec869df6e4cb6c4f14dbe8748cf6b3f9aad2f3b09baa7c61285cb5a5f1253b5bd9525470a25ca77fbe2d26ed02ae7d955142970e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
aea1462e5f1f31dd74df7833b5a07305

SHA1
cea53b9b3311f1003df5d9266f9e3fbd5c971f28

SHA256
62c957db467d22cf12af74a4dae478e7d239ecae5d53f3c6399583f38f5224af

SHA512
776eeffb068df67e852191f5ec869df6e4cb6c4f14dbe8748cf6b3f9aad2f3b09baa7c61285cb5a5f1253b5bd9525470a25ca77fbe2d26ed02ae7d955142970e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
aea1462e5f1f31dd74df7833b5a07305

SHA1
cea53b9b3311f1003df5d9266f9e3fbd5c971f28

SHA256
62c957db467d22cf12af74a4dae478e7d239ecae5d53f3c6399583f38f5224af

SHA512
776eeffb068df67e852191f5ec869df6e4cb6c4f14dbe8748cf6b3f9aad2f3b09baa7c61285cb5a5f1253b5bd9525470a25ca77fbe2d26ed02ae7d955142970e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
aea1462e5f1f31dd74df7833b5a07305

SHA1
cea53b9b3311f1003df5d9266f9e3fbd5c971f28

SHA256
62c957db467d22cf12af74a4dae478e7d239ecae5d53f3c6399583f38f5224af

SHA512
776eeffb068df67e852191f5ec869df6e4cb6c4f14dbe8748cf6b3f9aad2f3b09baa7c61285cb5a5f1253b5bd9525470a25ca77fbe2d26ed02ae7d955142970e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
aea1462e5f1f31dd74df7833b5a07305

SHA1
cea53b9b3311f1003df5d9266f9e3fbd5c971f28

SHA256
62c957db467d22cf12af74a4dae478e7d239ecae5d53f3c6399583f38f5224af

SHA512
776eeffb068df67e852191f5ec869df6e4cb6c4f14dbe8748cf6b3f9aad2f3b09baa7c61285cb5a5f1253b5bd9525470a25ca77fbe2d26ed02ae7d955142970e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
aea1462e5f1f31dd74df7833b5a07305

SHA1
cea53b9b3311f1003df5d9266f9e3fbd5c971f28

SHA256
62c957db467d22cf12af74a4dae478e7d239ecae5d53f3c6399583f38f5224af

SHA512
776eeffb068df67e852191f5ec869df6e4cb6c4f14dbe8748cf6b3f9aad2f3b09baa7c61285cb5a5f1253b5bd9525470a25ca77fbe2d26ed02ae7d955142970e

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
59KB

MD5
aea1462e5f1f31dd74df7833b5a07305

SHA1
cea53b9b3311f1003df5d9266f9e3fbd5c971f28

SHA256
62c957db467d22cf12af74a4dae478e7d239ecae5d53f3c6399583f38f5224af

SHA512
776eeffb068df67e852191f5ec869df6e4cb6c4f14dbe8748cf6b3f9aad2f3b09baa7c61285cb5a5f1253b5bd9525470a25ca77fbe2d26ed02ae7d955142970e

Download Submit
memory/936-58-0x0000000000000000-mapping.dmp

Download
memory/1020-60-0x0000000000000000-mapping.dmp

Download
memory/1692-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1692-54-0x0000000000000000-mapping.dmp

Download
memory/1692-67-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download