Analysis
-
max time kernel
185s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 18:56
Static task
static1
Behavioral task
behavioral1
Sample
36abaf79f3ee631e484e5d0ad2861b3a661ad0520fd1317a518aed60c59110a1.dll
Resource
win7-20220812-en
General
-
Target
36abaf79f3ee631e484e5d0ad2861b3a661ad0520fd1317a518aed60c59110a1.dll
-
Size
155KB
-
MD5
17cc44e2e51f83bc83111cf6f9d38b4b
-
SHA1
9c324141fe74a67e60848ddd097a1a5b67e8bdf4
-
SHA256
36abaf79f3ee631e484e5d0ad2861b3a661ad0520fd1317a518aed60c59110a1
-
SHA512
75017d43c72a7d42956477eee3353e4b454a883eed72bce5f71066861a325cdefe91c2a24779935300f1483d3b78ff018cd0368f16b56c4d1462cffe687ea102
-
SSDEEP
3072:EEerWSF+6RjZiq2uW1xZfsVF4ZCeeZaXBqsWX:E7r2I721vfsVeZ+gXBqsG
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32mgr.exepid process 2100 rundll32mgr.exe -
Processes:
resource yara_rule behavioral2/memory/2100-137-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
rundll32mgr.exepid process 2100 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 460 2100 WerFault.exe rundll32mgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1108 wrote to memory of 4560 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 4560 1108 rundll32.exe rundll32.exe PID 1108 wrote to memory of 4560 1108 rundll32.exe rundll32.exe PID 4560 wrote to memory of 2100 4560 rundll32.exe rundll32mgr.exe PID 4560 wrote to memory of 2100 4560 rundll32.exe rundll32mgr.exe PID 4560 wrote to memory of 2100 4560 rundll32.exe rundll32mgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36abaf79f3ee631e484e5d0ad2861b3a661ad0520fd1317a518aed60c59110a1.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36abaf79f3ee631e484e5d0ad2861b3a661ad0520fd1317a518aed60c59110a1.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 4804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2100 -ip 21001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\~TM2FCA.tmpFilesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
106KB
MD57657fcb7d772448a6d8504e4b20168b8
SHA184c7201f7e59cb416280fd69a2e7f2e349ec8242
SHA25654bc950d46a0d1aa72048a17c8275743209e6c17bdacfc4cb9601c9ce3ec9a71
SHA512786addd2a793bd4123625b22dc717d193246442ac97f1c3f4a763ec794b48e68051cd41097c0e9f7367e6914534f36eafccb109ab03dc793d68bf1522e7884e2
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
106KB
MD57657fcb7d772448a6d8504e4b20168b8
SHA184c7201f7e59cb416280fd69a2e7f2e349ec8242
SHA25654bc950d46a0d1aa72048a17c8275743209e6c17bdacfc4cb9601c9ce3ec9a71
SHA512786addd2a793bd4123625b22dc717d193246442ac97f1c3f4a763ec794b48e68051cd41097c0e9f7367e6914534f36eafccb109ab03dc793d68bf1522e7884e2
-
memory/2100-133-0x0000000000000000-mapping.dmp
-
memory/2100-137-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2100-138-0x00000000006A0000-0x00000000006CA000-memory.dmpFilesize
168KB
-
memory/2100-139-0x0000000077080000-0x0000000077223000-memory.dmpFilesize
1.6MB
-
memory/4560-132-0x0000000000000000-mapping.dmp