f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd

Analysis

max time kernel
3s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll
Size

738KB
MD5

0bfb96723fd4b34049b50d646fa03197
SHA1

ea6a64b044487026c3369f3ba522dd670e6d5ee2
SHA256

f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd
SHA512

30cb58ae6b85e39ac15d0508e6e64332bc606f73e32c9bb3de0d19e6a9f853357160249363b73a457f9dc59b5f074ed878d963f19f5415794c677095baa4a948
SSDEEP

12288:MwGsNHl+QXfQrKFAVUBhrTVNXO7H7N7u18rdHQ8aq+DFER:+sNHlNfQrKFEUn9N+bZu18rdHQ8a7DFM

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1020 2040 WerFault.exe rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

pid	pid_target	process	target process
1020	2040	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1252 wrote to memory of 2040	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2040	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2040	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2040	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2040	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2040	1252	rundll32.exe	rundll32.exe
PID 1252 wrote to memory of 2040	1252	rundll32.exe	rundll32.exe
PID 2040 wrote to memory of 1020	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1020	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1020	2040	rundll32.exe	WerFault.exe
PID 2040 wrote to memory of 1020	2040	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll,#1
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 532
3⤵
- Program crash
PID:1020

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-60-0x0000000000000000-mapping.dmp

Download
memory/2040-54-0x0000000000000000-mapping.dmp

Download
memory/2040-55-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x0000000010000000-0x00000000102AE000-memory.dmp

Filesize
2.7MB

Download