55df681eccb3c13ed4a8fcffcbbe867258b92fe267b6f7e63bcbdb572ee0f1cd

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2023, 01:25

Target

1819b02e5de2331b27a7d8d58acb27d26fa35b85fc9ce6fcbb742705f712d3a2.dll
Size

1.0MB
MD5

7b4ebf09cf37a88ab510a9fc4657f15e
SHA1

17fe7c8f1197359f0593bee491bc502debf9773e
SHA256

1819b02e5de2331b27a7d8d58acb27d26fa35b85fc9ce6fcbb742705f712d3a2
SHA512

6ee02ca7ef42ae2194ae29238d8b2101d73af5539ad5c6e85a70c7b31640d96043539eeca714fffae33d522a8b73e6b8e7060130c3688ffa3ff8a63aada75920
SSDEEP

24576:iMq/RX0hoa8wrC+azFbtZhUYFauTZyRMX3:iioa8wrCHz3ZhUYRAE3

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2092	2324	WerFault.exe	46

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1819b02e5de2331b27a7d8d58acb27d26fa35b85fc9ce6fcbb742705f712d3a2.dll,#1
1⤵
PID:2324
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2324 -s 644
  2⤵
  - Program crash
  PID:2092

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 464 -p 2324 -ip 2324
1⤵
PID:2616

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact