2e867f5354044d36e1fc8f47f917c7cc8ffcf00067fa313d907a67124816c9fc

Analysis

max time kernel
144s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/02/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
119489552F8016FB96AFAA3AE1B86AC3.dll
Size 6.4MB
Sample240206-2l4f2sbger
SHA256 2e867f5354044d36e1fc8f47f917c7cc8ffcf00067fa313d907a67124816c9fc
MD5 119489552f8016fb96afaa3ae1b86ac3
SHA1 97cb1d48e22505634d2b7dcdf24c0f1ef04730f1
SHA512 f0f05b558ec149e734d256f61d7972be5e548051b0f87c3d7176e88dee7d3584cd646cc0dc5c3b60225e117255c68368c259e92c85e9a9bd2a889039bc8d6c61
SSDEEP 98304:prtQdeVyH3Mw3bB5xNY+x2MYQ86CdebG2YlT:pr6devwL1i+CQ85gGNl
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	1036	WerFault.exe	28

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1036	1632	rundll32.exe	28
PID 1632 wrote to memory of 1036	1632	rundll32.exe	28
PID 1632 wrote to memory of 1036	1632	rundll32.exe	28
PID 1632 wrote to memory of 1036	1632	rundll32.exe	28
PID 1632 wrote to memory of 1036	1632	rundll32.exe	28
PID 1632 wrote to memory of 1036	1632	rundll32.exe	28
PID 1632 wrote to memory of 1036	1632	rundll32.exe	28
PID 1036 wrote to memory of 1980	1036	rundll32.exe	29
PID 1036 wrote to memory of 1980	1036	rundll32.exe	29
PID 1036 wrote to memory of 1980	1036	rundll32.exe	29
PID 1036 wrote to memory of 1980	1036	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\119489552F8016FB96AFAA3AE1B86AC3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\119489552F8016FB96AFAA3AE1B86AC3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 524
    3⤵
    - Program crash
    PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-0-0x0000000002280000-0x00000000028F0000-memory.dmp

Download

memory/1036-1-0x0000000003000000-0x0000000003802000-memory.dmp

Download

memory/1036-2-0x0000000003000000-0x0000000003802000-memory.dmp

Download

memory/1036-3-0x0000000002280000-0x00000000028F0000-memory.dmp

Download

memory/1036-5-0x0000000003000000-0x0000000003802000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads