Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 00:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cac9ba2eadcf365d9cc4a00cdf8df1fbc48761986289cd96c055b85093b12f08.dll
Resource
win7-20230712-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
cac9ba2eadcf365d9cc4a00cdf8df1fbc48761986289cd96c055b85093b12f08.dll
Resource
win10v2004-20230703-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
cac9ba2eadcf365d9cc4a00cdf8df1fbc48761986289cd96c055b85093b12f08.dll
-
Size
1.4MB
-
MD5
c1268d533bd885d25d4a982e1c237524
-
SHA1
e57cff1de71d28492f6a5004e3d0485200803831
-
SHA256
cac9ba2eadcf365d9cc4a00cdf8df1fbc48761986289cd96c055b85093b12f08
-
SHA512
e6b1a5fc0c944bc7c89fdb18e265a83e555a2b6d50b54c2446ba5aea86dc126453677b91e3540cbc4839ff9082089716a52ac69f2176465428a11eb7779d8363
-
SSDEEP
24576:H/0P20gbA/F05ZIeMICVoQIZYYqIIYWOKHf0ik:HTL7CVoIYq4tKHfvk
Score
3/10
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 2504 4140 WerFault.exe 81 2820 4140 WerFault.exe 81 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4140 rundll32.exe 4140 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4140 rundll32.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe 4140 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 228 wrote to memory of 4140 228 rundll32.exe 81 PID 228 wrote to memory of 4140 228 rundll32.exe 81 PID 228 wrote to memory of 4140 228 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cac9ba2eadcf365d9cc4a00cdf8df1fbc48761986289cd96c055b85093b12f08.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cac9ba2eadcf365d9cc4a00cdf8df1fbc48761986289cd96c055b85093b12f08.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4140 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 7963⤵
- Program crash
PID:2504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 6043⤵
- Program crash
PID:2820
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4140 -ip 41401⤵PID:748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4140 -ip 41401⤵PID:4216