317de7a10ace036e37d3a244516ca67eb674d458c33569c91c911c69481a518c

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
10/08/2023, 14:52

Target

Rat/libcef.dll
Size

795KB
MD5

1367469d2e42b0d2d3d33d65c0f99a06
SHA1

5d177af01e5a7c5b1c0920296c7c411a0bfef2d0
SHA256

220533caffc31750c9e7d8226eca3d05c525df59fc81093c175001a0c2e68fb5
SHA512

5bb1590dbe4b72c3bbacb00c48a4495f8ddd9276630c01019cfca86c65eff6f2daebc0c8f243230831d639be14bcef14cc77b8785017dcbbc7d769f457f8005d
SSDEEP

12288:8VbGGQ7NoRFNsqejyVP79uM9jaU1fzjuWu5tYXxPSUu0oe8RrOb0EoA:8Z25onNjZDjagzqRM8TdA

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1936	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	1936	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1936	1208	rundll32.exe	28
PID 1208 wrote to memory of 1936	1208	rundll32.exe	28
PID 1208 wrote to memory of 1936	1208	rundll32.exe	28
PID 1208 wrote to memory of 1936	1208	rundll32.exe	28
PID 1208 wrote to memory of 1936	1208	rundll32.exe	28
PID 1208 wrote to memory of 1936	1208	rundll32.exe	28
PID 1208 wrote to memory of 1936	1208	rundll32.exe	28
PID 1936 wrote to memory of 2608	1936	rundll32.exe	29
PID 1936 wrote to memory of 2608	1936	rundll32.exe	29
PID 1936 wrote to memory of 2608	1936	rundll32.exe	29
PID 1936 wrote to memory of 2608	1936	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rat\libcef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rat\libcef.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 284
    3⤵
    - Program crash
    PID:2608

memory/1936-53-0x0000000074970000-0x0000000074B03000-memory.dmp

Filesize
1.6MB

Download
memory/1936-54-0x0000000074970000-0x0000000074B03000-memory.dmp

Filesize
1.6MB

Download
memory/1936-55-0x0000000074750000-0x00000000748E3000-memory.dmp

Filesize
1.6MB

Download
memory/1936-56-0x0000000074750000-0x00000000748E3000-memory.dmp

Filesize
1.6MB

Download
memory/1936-58-0x0000000074750000-0x00000000748E3000-memory.dmp

Filesize
1.6MB

Download
memory/1936-59-0x0000000074750000-0x00000000748E3000-memory.dmp

Filesize
1.6MB

Download
memory/1936-60-0x0000000074750000-0x00000000748E3000-memory.dmp

Filesize
1.6MB

Download
memory/1936-61-0x00000000025B0000-0x00000000025F0000-memory.dmp

Filesize
256KB

Download
memory/1936-62-0x0000000074750000-0x00000000748E3000-memory.dmp

Filesize
1.6MB

Download
memory/1936-63-0x00000000025B0000-0x00000000025F0000-memory.dmp

Filesize
256KB

Download
memory/1936-70-0x0000000074970000-0x0000000074B03000-memory.dmp

Filesize
1.6MB

Download