4f78ade55eef0c4ec12951e8df7aec12337e256b81948154194f39b971ab93e9

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f78ade55eef0c4ec12951e8df7aec12337e256b81948154194f39b971ab93e9.dll
Size

5.6MB
MD5

6768c1eedda3d90f254c711f677391d1
SHA1

7815599208885fcb9f0083af0c7bfbee189228a3
SHA256

4f78ade55eef0c4ec12951e8df7aec12337e256b81948154194f39b971ab93e9
SHA512

cdcb4c02ba8bdbf1201d9cf339a6ad2e6fef241c2b0ca3bbbaaa3175b8b3160866844f783eeeb9cafb9988d59ee4cdfef0bd23a9324915a3ae37ce5f1748252b
SSDEEP

98304:M5Bw2Bzx0k9/BZXxkIWPG1f5e7aU2Sz9NwrZBJAY//:ABl0sBZBkIvhe7aUnNs/

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1620 968 WerFault.exe rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

pid	pid_target	process	target process
1620	968	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 2000 wrote to memory of 968	2000	rundll32.exe	rundll32.exe
PID 968 wrote to memory of 1620	968	rundll32.exe	WerFault.exe
PID 968 wrote to memory of 1620	968	rundll32.exe	WerFault.exe
PID 968 wrote to memory of 1620	968	rundll32.exe	WerFault.exe
PID 968 wrote to memory of 1620	968	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f78ade55eef0c4ec12951e8df7aec12337e256b81948154194f39b971ab93e9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f78ade55eef0c4ec12951e8df7aec12337e256b81948154194f39b971ab93e9.dll,#1
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 316
3⤵
- Program crash
PID:1620

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-54-0x0000000000000000-mapping.dmp

Download
memory/968-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1620-56-0x0000000000000000-mapping.dmp

Download