f702dfddbc5b4f1d5a5a9db0a2c013900d30515e69a09420a7c3f6eaac901b12

Analysis

max time kernel
61s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2023, 13:48

Target

xmlprov.dll
Size

2.6MB
MD5

b693e3d2f2cab550ad4f8c5722776498
SHA1

6dc93db10d46cf777f9928803157dd16dc097e79
SHA256

f702dfddbc5b4f1d5a5a9db0a2c013900d30515e69a09420a7c3f6eaac901b12
SHA512

d5c02150265ab6d5d2d6a6e39514b345f6108afaecfd0d8e196b0b99d6d1af36245eb12e8a6879f16b619ba89f8eec442c394eff5f6298d1534c9f0084d63f18
SSDEEP

49152:xL+qLntVtOg3gJjW4UeJiGew5o/ylRbUlo60bNBUDXVFhIECIpuXo+kY8ss:tHnsg3gZHUeANwl6SuF+SFss

Score

5^/10

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	4700	WerFault.exe	53

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2472	mspaint.exe
2472	mspaint.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2472	mspaint.exe
4468	OpenWith.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\xmlprov.dll,#1
1⤵
PID:4700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4700 -s 356
  2⤵
  - Program crash
  PID:2380

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 4700 -ip 4700
1⤵
PID:4304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:1936

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4468

memory/1936-133-0x000001351A570000-0x000001351A580000-memory.dmp

Filesize
64KB

Download
memory/1936-137-0x000001351A5B0000-0x000001351A5C0000-memory.dmp

Filesize
64KB

Download
memory/1936-144-0x0000013523100000-0x0000013523101000-memory.dmp

Filesize
4KB

Download
memory/1936-146-0x0000013523180000-0x0000013523181000-memory.dmp

Filesize
4KB

Download
memory/1936-148-0x0000013523180000-0x0000013523181000-memory.dmp

Filesize
4KB

Download
memory/1936-149-0x0000013523210000-0x0000013523211000-memory.dmp

Filesize
4KB

Download
memory/1936-150-0x0000013523210000-0x0000013523211000-memory.dmp

Filesize
4KB

Download
memory/1936-151-0x0000013523210000-0x0000013523211000-memory.dmp

Filesize
4KB

Download
memory/1936-152-0x0000013523210000-0x0000013523211000-memory.dmp

Filesize
4KB

Download