81d7a32eb3d9f75a3e334d6b6052c9f8df5958ec9b6d2c16253bd9a82411b7ea

Resubmissions

10/01/2024, 11:09

240110-m9mqwaebhk3

10/01/2024, 11:08

10/01/2024, 11:04

10/01/2024, 09:40

10/01/2024, 09:19

10/01/2024, 09:13

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
toolsubs.dll
Size 210KB
Sample240110-k64twacedj
SHA256 3bb4136deb5e5830c53f659074b5978db22d71108e34100976ac3ebd28a0276e
MD5 8d83358e80c471060cc82751a79f4188
SHA1 75e38e301e9af6fcd8b576e609fd8105ca0e37a5
SHA512 751b23cb8e8af1f55b3405ccd296e6117c88a11b053fd75fe54bfe4ea535ebb16abd65a9b434a385105462f02c01b9d770b74976ac3852b78b1d25d30217afbc
SSDEEP 6144:S2ANNCDxWamHGSOejsoUuhveinn2GjjRa4BrTE:iCDxuHGeAoesnN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process
3024	2964	WerFault.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2964	2248	rundll32.exe	15
PID 2248 wrote to memory of 2964	2248	rundll32.exe	15
PID 2248 wrote to memory of 2964	2248	rundll32.exe	15
PID 2248 wrote to memory of 2964	2248	rundll32.exe	15
PID 2248 wrote to memory of 2964	2248	rundll32.exe	15
PID 2248 wrote to memory of 2964	2248	rundll32.exe	15
PID 2248 wrote to memory of 2964	2248	rundll32.exe	15
PID 2964 wrote to memory of 3024	2964	rundll32.exe	14
PID 2964 wrote to memory of 3024	2964	rundll32.exe	14
PID 2964 wrote to memory of 3024	2964	rundll32.exe	14
PID 2964 wrote to memory of 3024	2964	rundll32.exe	14

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 228
1⤵
- Program crash
PID:3024

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\toolsubs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\toolsubs.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-0-0x0000000050B70000-0x0000000050C06000-memory.dmp

Download

memory/2964-6-0x0000000010000000-0x000000001000F000-memory.dmp

Download

memory/2964-5-0x0000000000160000-0x0000000000161000-memory.dmp

Download

memory/2964-4-0x0000000000140000-0x0000000000142000-memory.dmp

Download

memory/2964-3-0x0000000050B70000-0x0000000050C06000-memory.dmp

Download

memory/2964-2-0x0000000050B70000-0x0000000050C06000-memory.dmp

Download

memory/2964-1-0x0000000050B70000-0x0000000050C06000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads