Overview

overview

3

Static

static

3

13c1d3533d...c2.dll

windows7-x64

3

13c1d3533d...c2.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    142s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 09:04 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    13c1d3533d75eaa04242171fa3c255c2.dll

  • Size

    208KB

  • MD5

    13c1d3533d75eaa04242171fa3c255c2

  • SHA1

    e15a2883083a169848fae88c584c7a434c8cd836

  • SHA256

    719aecf90bd0b4724543bf28da6a9410dd1228bbb2b8068ba27753e927905db9

  • SHA512

    cdaad269938ddee3e171b6249dcaa8bfb2c0b6a2e20d458a6bc58aff5eba37228bd05b16a3b599d52cc5e0165669af22072f7eb0786ee87fd44fe9da3908d9bc

  • SSDEEP

    3072:gn1hG1MrkCkyD/VJcFyaupo2yw/awYwBlUHFtwFPM:VKj/wnRwSYUYFk

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\13c1d3533d75eaa04242171fa3c255c2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\13c1d3533d75eaa04242171fa3c255c2.dll,#1
      2⤵
        PID:5072
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 592
          3⤵
          • Program crash
          PID:4612
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 864
          3⤵
          • Program crash
          PID:1280
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5072 -ip 5072
      1⤵
        PID:2072
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5072 -ip 5072
        1⤵
          PID:3624

        Network

        • flag-us
          DNS
          2.136.104.51.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          2.136.104.51.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          0.205.248.87.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          0.205.248.87.in-addr.arpa
          IN PTR
          Response
          0.205.248.87.in-addr.arpa
          IN PTR
          https-87-248-205-0lgwllnwnet
        • flag-us
          DNS
          83.177.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          83.177.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          9.228.82.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          9.228.82.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          205.47.74.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          205.47.74.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          20.177.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          20.177.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          41.110.16.96.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          41.110.16.96.in-addr.arpa
          IN PTR
          Response
          41.110.16.96.in-addr.arpa
          IN PTR
          a96-16-110-41deploystaticakamaitechnologiescom
        • flag-us
          DNS
          146.78.124.51.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          146.78.124.51.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          86.23.85.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          86.23.85.13.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          86.23.85.13.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          86.23.85.13.in-addr.arpa
          IN PTR
        • flag-us
          DNS
          171.39.242.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          171.39.242.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          171.39.242.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          171.39.242.20.in-addr.arpa
          IN PTR
        • flag-us
          DNS
          18.134.221.88.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          18.134.221.88.in-addr.arpa
          IN PTR
          Response
          18.134.221.88.in-addr.arpa
          IN PTR
          a88-221-134-18deploystaticakamaitechnologiescom
        • flag-us
          DNS
          43.58.199.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          43.58.199.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          tse1.mm.bing.net
          Remote address:
          8.8.8.8:53
          Request
          tse1.mm.bing.net
          IN A
          Response
          tse1.mm.bing.net
          IN CNAME
          mm-mm.bing.net.trafficmanager.net
          mm-mm.bing.net.trafficmanager.net
          IN CNAME
          dual-a-0001.a-msedge.net
          dual-a-0001.a-msedge.net
          IN A
          204.79.197.200
          dual-a-0001.a-msedge.net
          IN A
          13.107.21.200
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239317301191_1O2H8JRMOAALOPCGS&pid=21.2&w=1920&h=1080&c=4
          Remote address:
          204.79.197.200:443
          Request
          GET /th?id=OADD2.10239317301191_1O2H8JRMOAALOPCGS&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 281379
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: 4FB0D630B60548408867A86B6CD5618C Ref B: LON04EDGE0807 Ref C: 2023-12-27T19:27:01Z
          date: Wed, 27 Dec 2023 19:27:01 GMT
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239317301600_1WSZ3EMFYHR1KRB2N&pid=21.2&w=1080&h=1920&c=4
          Remote address:
          204.79.197.200:443
          Request
          GET /th?id=OADD2.10239317301600_1WSZ3EMFYHR1KRB2N&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 330684
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: F6B928D844924ABFB36C274436249830 Ref B: LON04EDGE0807 Ref C: 2023-12-27T19:27:01Z
          date: Wed, 27 Dec 2023 19:27:01 GMT
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239317301555_15WHULHLEWM8YZRKT&pid=21.2&w=1080&h=1920&c=4
          Remote address:
          204.79.197.200:443
          Request
          GET /th?id=OADD2.10239317301555_15WHULHLEWM8YZRKT&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 428833
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: 256478FDF70E40448BD5E29F259DC881 Ref B: LON04EDGE0807 Ref C: 2023-12-27T19:27:01Z
          date: Wed, 27 Dec 2023 19:27:01 GMT
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239317301146_1A6Y190CSARJQINGA&pid=21.2&w=1920&h=1080&c=4
          Remote address:
          204.79.197.200:443
          Request
          GET /th?id=OADD2.10239317301146_1A6Y190CSARJQINGA&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 477205
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: 6D5193F0CC2A4025834C09825035B8EE Ref B: LON04EDGE0807 Ref C: 2023-12-27T19:27:02Z
          date: Wed, 27 Dec 2023 19:27:02 GMT
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239317301216_1YVZ0IIVCJV3CQIQF&pid=21.2&w=1920&h=1080&c=4
          Remote address:
          204.79.197.200:443
          Request
          GET /th?id=OADD2.10239317301216_1YVZ0IIVCJV3CQIQF&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
          Response
          HTTP/2.0 200
          cache-control: public, max-age=2592000
          content-length: 278792
          content-type: image/jpeg
          x-cache: TCP_HIT
          access-control-allow-origin: *
          access-control-allow-headers: *
          access-control-allow-methods: GET, POST, OPTIONS
          timing-allow-origin: *
          report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
          nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
          accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
          x-msedge-ref: Ref A: DB19F34F675641E09D73AC22F75AC621 Ref B: LON04EDGE0807 Ref C: 2023-12-27T19:27:05Z
          date: Wed, 27 Dec 2023 19:27:05 GMT
        • flag-us
          GET
          https://tse1.mm.bing.net/th?id=OADD2.10239317301625_1HP779E00BH478LC1&pid=21.2&w=1080&h=1920&c=4
          Remote address:
          204.79.197.200:443
          Request
          GET /th?id=OADD2.10239317301625_1HP779E00BH478LC1&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
          host: tse1.mm.bing.net
          accept: */*
          accept-encoding: gzip, deflate, br
          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        • flag-us
          DNS
          28.179.17.96.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          28.179.17.96.in-addr.arpa
          IN PTR
          Response
          28.179.17.96.in-addr.arpa
          IN PTR
          a96-17-179-28deploystaticakamaitechnologiescom
        • flag-us
          DNS
          200.197.79.204.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          200.197.79.204.in-addr.arpa
          IN PTR
          Response
          200.197.79.204.in-addr.arpa
          IN PTR
          a-0001a-msedgenet
        • flag-us
          DNS
          158.240.127.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          158.240.127.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          158.240.127.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          158.240.127.40.in-addr.arpa
          IN PTR
        • flag-us
          DNS
          81.171.91.138.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          81.171.91.138.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          81.171.91.138.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          81.171.91.138.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          19.229.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          19.229.111.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          19.229.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          19.229.111.52.in-addr.arpa
          IN PTR
        • flag-us
          DNS
          27.73.42.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          27.73.42.20.in-addr.arpa
          IN PTR
          Response
        • 52.142.223.178:80
          104 B
           2
        • 204.79.197.200:443
          tse1.mm.bing.net
          tls, http2
          1.3kB
           10.0kB
           17
          13
        • 204.79.197.200:443
          https://tse1.mm.bing.net/th?id=OADD2.10239317301625_1HP779E00BH478LC1&pid=21.2&w=1080&h=1920&c=4
          tls, http2
          69.1kB
           1.9MB
           1384
          1372

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239317301191_1O2H8JRMOAALOPCGS&pid=21.2&w=1920&h=1080&c=4

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239317301600_1WSZ3EMFYHR1KRB2N&pid=21.2&w=1080&h=1920&c=4

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239317301555_15WHULHLEWM8YZRKT&pid=21.2&w=1080&h=1920&c=4

          HTTP Response

          200

          HTTP Response

          200

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239317301146_1A6Y190CSARJQINGA&pid=21.2&w=1920&h=1080&c=4

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239317301216_1YVZ0IIVCJV3CQIQF&pid=21.2&w=1920&h=1080&c=4

          HTTP Response

          200

          HTTP Request

          GET https://tse1.mm.bing.net/th?id=OADD2.10239317301625_1HP779E00BH478LC1&pid=21.2&w=1080&h=1920&c=4

          HTTP Response

          200

          HTTP Response

          200
        • 204.79.197.200:443
          tse1.mm.bing.net
          tls, http2
          1.5kB
           10.1kB
           20
          13
        • 8.8.8.8:53
          2.136.104.51.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          2.136.104.51.in-addr.arpa

        • 8.8.8.8:53
          0.205.248.87.in-addr.arpa
          dns
          71 B
           116 B
           1
          1

          DNS Request

          0.205.248.87.in-addr.arpa

        • 8.8.8.8:53
          83.177.190.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          83.177.190.20.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          9.228.82.20.in-addr.arpa
          dns
          70 B
           156 B
           1
          1

          DNS Request

          9.228.82.20.in-addr.arpa

        • 8.8.8.8:53
          205.47.74.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          205.47.74.20.in-addr.arpa

        • 8.8.8.8:53
          20.177.190.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          20.177.190.20.in-addr.arpa

        • 8.8.8.8:53
          41.110.16.96.in-addr.arpa
          dns
          71 B
           135 B
           1
          1

          DNS Request

          41.110.16.96.in-addr.arpa

        • 8.8.8.8:53
          146.78.124.51.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          146.78.124.51.in-addr.arpa

        • 8.8.8.8:53
          86.23.85.13.in-addr.arpa
          dns
          140 B
           144 B
           2
          1

          DNS Request

          86.23.85.13.in-addr.arpa

          DNS Request

          86.23.85.13.in-addr.arpa

        • 8.8.8.8:53
          171.39.242.20.in-addr.arpa
          dns
          144 B
           158 B
           2
          1

          DNS Request

          171.39.242.20.in-addr.arpa

          DNS Request

          171.39.242.20.in-addr.arpa

        • 8.8.8.8:53
          18.134.221.88.in-addr.arpa
          dns
          72 B
           137 B
           1
          1

          DNS Request

          18.134.221.88.in-addr.arpa

        • 8.8.8.8:53
          43.58.199.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          43.58.199.20.in-addr.arpa

        • 8.8.8.8:53
          tse1.mm.bing.net
          dns
          62 B
           173 B
           1
          1

          DNS Request

          tse1.mm.bing.net

          DNS Response

          204.79.197.200
          13.107.21.200

        • 8.8.8.8:53
          28.179.17.96.in-addr.arpa
          dns
          71 B
           135 B
           1
          1

          DNS Request

          28.179.17.96.in-addr.arpa

        • 8.8.8.8:53
          200.197.79.204.in-addr.arpa
          dns
          73 B
           106 B
           1
          1

          DNS Request

          200.197.79.204.in-addr.arpa

        • 8.8.8.8:53
          158.240.127.40.in-addr.arpa
          dns
          146 B
           147 B
           2
          1

          DNS Request

          158.240.127.40.in-addr.arpa

          DNS Request

          158.240.127.40.in-addr.arpa

        • 8.8.8.8:53
          81.171.91.138.in-addr.arpa
          dns
          144 B
           292 B
           2
          2

          DNS Request

          81.171.91.138.in-addr.arpa

          DNS Request

          81.171.91.138.in-addr.arpa

        • 8.8.8.8:53
          19.229.111.52.in-addr.arpa
          dns
          144 B
           158 B
           2
          1

          DNS Request

          19.229.111.52.in-addr.arpa

          DNS Request

          19.229.111.52.in-addr.arpa

        • 8.8.8.8:53
          27.73.42.20.in-addr.arpa
          dns
          70 B
           156 B
           1
          1

          DNS Request

          27.73.42.20.in-addr.arpa

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.