Analysis
-
max time kernel
37s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 21:06
Behavioral task
behavioral1
Sample
b70ddd140c1faaf7141a6ea14e89ea09cce0aa145464b6fe014f58603c0d7d51.dll
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b70ddd140c1faaf7141a6ea14e89ea09cce0aa145464b6fe014f58603c0d7d51.dll
-
Size
6.4MB
-
MD5
8cb688d3c02247a6fe544d258ca44a2f
-
SHA1
0c95f708431ec07db2c65df5e87127d94d4d2160
-
SHA256
b70ddd140c1faaf7141a6ea14e89ea09cce0aa145464b6fe014f58603c0d7d51
-
SHA512
7db141769c7fb644f7d918c97fe5042fe4bf1dcf74268e9355ec038f088434e19845c4ddd6969e73037246ee812119e69b474e2e62c4185d5c296550e1492b77
-
SSDEEP
196608:D6iYk88ric/gOJN739l3ikMWs8w6xHIVH2ut:evcriGgYNLG1j8baIC
Malware Config
Signatures
-
Detect Numando payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2000-57-0x0000000001DE0000-0x00000000027BB000-memory.dmp family_numando -
Processes:
resource yara_rule behavioral1/memory/2000-57-0x0000000001DE0000-0x00000000027BB000-memory.dmp upx -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1372 2000 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1012 wrote to memory of 2000 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 2000 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 2000 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 2000 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 2000 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 2000 1012 rundll32.exe rundll32.exe PID 1012 wrote to memory of 2000 1012 rundll32.exe rundll32.exe PID 2000 wrote to memory of 1372 2000 rundll32.exe WerFault.exe PID 2000 wrote to memory of 1372 2000 rundll32.exe WerFault.exe PID 2000 wrote to memory of 1372 2000 rundll32.exe WerFault.exe PID 2000 wrote to memory of 1372 2000 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b70ddd140c1faaf7141a6ea14e89ea09cce0aa145464b6fe014f58603c0d7d51.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b70ddd140c1faaf7141a6ea14e89ea09cce0aa145464b6fe014f58603c0d7d51.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 3003⤵
- Program crash