Analysis
-
max time kernel
3s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 09:14
Static task
static1
Behavioral task
behavioral1
Sample
f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll
Resource
win10v2004-20221111-en
General
-
Target
f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll
-
Size
738KB
-
MD5
0bfb96723fd4b34049b50d646fa03197
-
SHA1
ea6a64b044487026c3369f3ba522dd670e6d5ee2
-
SHA256
f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd
-
SHA512
30cb58ae6b85e39ac15d0508e6e64332bc606f73e32c9bb3de0d19e6a9f853357160249363b73a457f9dc59b5f074ed878d963f19f5415794c677095baa4a948
-
SSDEEP
12288:MwGsNHl+QXfQrKFAVUBhrTVNXO7H7N7u18rdHQ8aq+DFER:+sNHlNfQrKFEUn9N+bZu18rdHQ8a7DFM
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1020 2040 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1252 wrote to memory of 2040 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2040 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2040 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2040 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2040 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2040 1252 rundll32.exe rundll32.exe PID 1252 wrote to memory of 2040 1252 rundll32.exe rundll32.exe PID 2040 wrote to memory of 1020 2040 rundll32.exe WerFault.exe PID 2040 wrote to memory of 1020 2040 rundll32.exe WerFault.exe PID 2040 wrote to memory of 1020 2040 rundll32.exe WerFault.exe PID 2040 wrote to memory of 1020 2040 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 5323⤵
- Program crash