Analysis
-
max time kernel
107s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2023, 22:09
Static task
static1
Behavioral task
behavioral1
Sample
a33f56d05b03c4bb75c972f8ddbb69b7a815484bee117a63c16b4c8dfca1543a.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a33f56d05b03c4bb75c972f8ddbb69b7a815484bee117a63c16b4c8dfca1543a.dll
Resource
win10v2004-20230220-en
General
-
Target
a33f56d05b03c4bb75c972f8ddbb69b7a815484bee117a63c16b4c8dfca1543a.dll
-
Size
5.6MB
-
MD5
58f99b07c5fa365700193f441a53963b
-
SHA1
2d5d46b5b80ad842c462d1ade5fbdb6822f38735
-
SHA256
a33f56d05b03c4bb75c972f8ddbb69b7a815484bee117a63c16b4c8dfca1543a
-
SHA512
86d29496c2653fd6b962013ff567efb5dc0bfecc6f51f6b6275a7d16bc9533e34c444bd76efae1ebed11a27f40726d167a32fea74d7b73d1a147da66ec7e3611
-
SSDEEP
98304:z/q6lOv0yBTBGj+GQw/7CbM8NWT/riv9HN9zX:z/q6lOv0yBT+dCbM8NWT/elnX
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 7 1728 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2768 1728 WerFault.exe 48 -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe 1728 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a33f56d05b03c4bb75c972f8ddbb69b7a815484bee117a63c16b4c8dfca1543a.dll,#11⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1728 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1728 -s 5082⤵
- Program crash
PID:2768
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 360 -p 1728 -ip 17281⤵PID:1552