Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2022 21:52
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp.exe
-
Size
1005KB
-
MD5
52a4ac130352fd65ad0f411799d74abe
-
SHA1
bb2d4993fc3cf1b110e81a68a26c606f71c10c3e
-
SHA256
1880b1a25e05835f30fb291b7871e594a85aec146c659ee32b8ab4f950635a4f
-
SHA512
2115c912a44b6e881558c6c593bf480882bdcddadb7401a1cea0841946f848865992287429eaf4d2950fb1f2753b903a5e58cafb9c5b7b06e909def98673bfbf
-
SSDEEP
24576:CYzxn6MvPWzlhSOjIi4K4dWRT63gqYbXF:CMxJvSIi4ipX
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3180 rundll32.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4884 4876 WerFault.exe tmp.exe 4548 3180 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
tmp.exedescription pid process target process PID 4876 wrote to memory of 3180 4876 tmp.exe rundll32.exe PID 4876 wrote to memory of 3180 4876 tmp.exe rundll32.exe PID 4876 wrote to memory of 3180 4876 tmp.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmp",Sufeidweoe2⤵
- Loads dropped DLL
PID:3180 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 8403⤵
- Program crash
PID:4548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 5282⤵
- Program crash
PID:4884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4876 -ip 48761⤵PID:4900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3180 -ip 31801⤵PID:628
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmpFilesize
726KB
MD56ea8a6cc5fed6c664df1b3ef7c56b55d
SHA16b244d708706441095ae97294928967ddf28432b
SHA2562c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA5124a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741
-
C:\Users\Admin\AppData\Local\Temp\Ipoetwsuqhd.tmpFilesize
726KB
MD56ea8a6cc5fed6c664df1b3ef7c56b55d
SHA16b244d708706441095ae97294928967ddf28432b
SHA2562c7500ac5ebb0116e640747b8a5f0a2648f7d2f5f516ebb398b864cccc626fbe
SHA5124a328a66df407e4c9fa230287104771ea3b5dd8265d60314797426101a8be19d13bc57de2388f0f90b20ada82d950e156ef4267c029080a6254b80eefd8b8741
-
memory/3180-135-0x0000000000000000-mapping.dmp
-
memory/4876-132-0x00000000022C6000-0x000000000239C000-memory.dmpFilesize
856KB
-
memory/4876-133-0x00000000023A0000-0x00000000024B5000-memory.dmpFilesize
1.1MB
-
memory/4876-134-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB
-
memory/4876-138-0x0000000000400000-0x0000000000523000-memory.dmpFilesize
1.1MB