Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 11:23
Static task
static1
Behavioral task
behavioral1
Sample
a/Files.lnk
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a/Files.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
a/seagem.bat
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
a/seagem.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
a/unedifying.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
a/unedifying.dll
Resource
win10v2004-20220812-en
General
-
Target
a/unedifying.dll
-
Size
269KB
-
MD5
012da0b3ac0042942cd3b37915e799ba
-
SHA1
848ec6dadfd86129908bf5cf51e34fb1d0e3ca62
-
SHA256
c7d63b44ed478fe48468ddee84beb324712b22602b8c8a1ee2de75445f18528e
-
SHA512
bc5f4f3940035a71d810692c65dbec81c3344f6a454c4b6cf666286edbeda737fdfdb962e7009d32a37a02476424c98605b7a054b312ca9f0b47168e8bc0948c
-
SSDEEP
6144:mTHJ5BU2WigC+/NZy40onBV14xjN8IcOzECLZ:8DB0igC+/NHBV1SjaCd
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 912 1692 WerFault.exe rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1692 rundll32.exe 1692 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1692 wrote to memory of 912 1692 rundll32.exe WerFault.exe PID 1692 wrote to memory of 912 1692 rundll32.exe WerFault.exe PID 1692 wrote to memory of 912 1692 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a\unedifying.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1692 -s 1522⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-54-0x0000000000000000-mapping.dmp