300c090861a547a4c211b15b9f45d6dcb976128c21b78b6c38d1cf4c5d998e12

Analysis

max time kernel
1418s
max time network
1180s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
27/02/2024, 09:42

Target
MinidukeAPT29.dll
Size 140KB
Sample240227-lpd3kade66
SHA256 c485cbcd5b21db8029654bd47879f086feed41492aebed33a9afe9d73f5069e7
MD5 887489b27f6e7053ec2702dc8ba51af7
SHA1 79176c5ad3aeca542f9043657bacf55368a63106
SHA512 2a5961a14851ada815319f16af0f44d27c35dfdee041a73e7da985a085964a1fb5cae08e8f40c41436800a137f284d945a3e5bfd04a46c37703daec3820988a1
SSDEEP 3072:fkumgrfr9NPhDZDEa4qRfOkE7qdjKdcE:MyrfrrhNEufOLi2l
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2792	4412	WerFault.exe	79
3572	4412	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4412	4384	rundll32.exe	79
PID 4384 wrote to memory of 4412	4384	rundll32.exe	79
PID 4384 wrote to memory of 4412	4384	rundll32.exe	79

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\MinidukeAPT29.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\MinidukeAPT29.dll,#1
  2⤵
  PID:4412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 496
    3⤵
    - Program crash
    PID:2792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 472
    3⤵
    - Program crash
    PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4412 -ip 4412
1⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4412 -ip 4412
1⤵
PID:4260