35334466f16e7e2ebbf3bf8f37b164698a7ca06b8f759a9449726ab341912162

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba217274423d9eefdc52bdec19dc38cb.dll
Size

4KB
MD5

ba217274423d9eefdc52bdec19dc38cb
SHA1

59839f89f2f7b6aa7a91acec49f4d0dac4e7317f
SHA256

35334466f16e7e2ebbf3bf8f37b164698a7ca06b8f759a9449726ab341912162
SHA512

2327e2e3239b9ba923b0e6e1ccf095147077dbfb44074b6d458c47302fe3a675ebe9158fd2ece35af4b95be3a1194c7cd8109948f748cfe2164fdadf02bf332b
SSDEEP

96:oQsN6Aq7Jvd+J7WDsVFsGWEDU5fHzLtF3O0CCc9wLyEcIkgcwQwTpjTxG:hsN67vd870sViBXlHzLSosaNcIkgUw9E

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1732	2032	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2032	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2032	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2012 wrote to memory of 2032	2012	rundll32.exe	28
PID 2032 wrote to memory of 1732	2032	rundll32.exe	29
PID 2032 wrote to memory of 1732	2032	rundll32.exe	29
PID 2032 wrote to memory of 1732	2032	rundll32.exe	29
PID 2032 wrote to memory of 1732	2032	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba217274423d9eefdc52bdec19dc38cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba217274423d9eefdc52bdec19dc38cb.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 232
    3⤵
    - Program crash
    PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download