Analysis
-
max time kernel
186s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 07:38
Static task
static1
Behavioral task
behavioral1
Sample
dcb4435511db5c546dc54e90a7803659d5cc8026b21fee5be8899f502ec74e8e.dll
Resource
win7-20220901-en
General
-
Target
dcb4435511db5c546dc54e90a7803659d5cc8026b21fee5be8899f502ec74e8e.dll
-
Size
193KB
-
MD5
02b4ecf766b8a1095b740fe09cd6da6b
-
SHA1
1fa84ab87171c9648b3f4132fd988ca1d301d651
-
SHA256
dcb4435511db5c546dc54e90a7803659d5cc8026b21fee5be8899f502ec74e8e
-
SHA512
71053e08173144d9a9e04b50648b58af6c209c4267e3fa25ce0afb12944a7c53a78f98252323abc675abadabe4fa6b62d2f74817a39c4fdf65d841b474280d4e
-
SSDEEP
3072:rOBOLWXivHYMzv2HvP5YeBTEEP2831Vr/rF8QOSta7WeG/Cl0ZRRGJ3aJ0DVfNLe:rOp8HpzdQOStKaoSvGmut1SVgsJEg7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32mgr.exepid process 4300 rundll32mgr.exe -
Processes:
resource yara_rule behavioral2/memory/4300-138-0x0000000000400000-0x0000000000444000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
rundll32mgr.exepid process 4300 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4396 4300 WerFault.exe rundll32mgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1444 wrote to memory of 4592 1444 rundll32.exe rundll32.exe PID 1444 wrote to memory of 4592 1444 rundll32.exe rundll32.exe PID 1444 wrote to memory of 4592 1444 rundll32.exe rundll32.exe PID 4592 wrote to memory of 4300 4592 rundll32.exe rundll32mgr.exe PID 4592 wrote to memory of 4300 4592 rundll32.exe rundll32mgr.exe PID 4592 wrote to memory of 4300 4592 rundll32.exe rundll32mgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dcb4435511db5c546dc54e90a7803659d5cc8026b21fee5be8899f502ec74e8e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dcb4435511db5c546dc54e90a7803659d5cc8026b21fee5be8899f502ec74e8e.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 101764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4300 -ip 43001⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\~TM273F.tmpFilesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
94KB
MD58b5f2036288762602f2916929b1ab9d8
SHA1351a0157960c3b009a9814a6e8b7f788ba798988
SHA25655751df54d8d54e5bb8edab83bd57fd599b2e9aa313233d6aa084cde167e6951
SHA51241a45bd5ff492cf2a01ad156f763854b1d5371d1a41cee4cad977c4ff25a561c1b3fbb067463e2b7278ac6878af139ff7fd695bed1f5883516a70031e9758bc1
-
C:\Windows\SysWOW64\rundll32mgr.exeFilesize
94KB
MD58b5f2036288762602f2916929b1ab9d8
SHA1351a0157960c3b009a9814a6e8b7f788ba798988
SHA25655751df54d8d54e5bb8edab83bd57fd599b2e9aa313233d6aa084cde167e6951
SHA51241a45bd5ff492cf2a01ad156f763854b1d5371d1a41cee4cad977c4ff25a561c1b3fbb067463e2b7278ac6878af139ff7fd695bed1f5883516a70031e9758bc1
-
memory/4300-133-0x0000000000000000-mapping.dmp
-
memory/4300-138-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/4300-139-0x0000000002180000-0x00000000021C4000-memory.dmpFilesize
272KB
-
memory/4300-140-0x0000000077080000-0x0000000077223000-memory.dmpFilesize
1.6MB
-
memory/4592-132-0x0000000000000000-mapping.dmp
-
memory/4592-137-0x0000000007000000-0x0000000007033000-memory.dmpFilesize
204KB