35334466f16e7e2ebbf3bf8f37b164698a7ca06b8f759a9449726ab341912162

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba217274423d9eefdc52bdec19dc38cb.dll
Size

4KB
MD5

ba217274423d9eefdc52bdec19dc38cb
SHA1

59839f89f2f7b6aa7a91acec49f4d0dac4e7317f
SHA256

35334466f16e7e2ebbf3bf8f37b164698a7ca06b8f759a9449726ab341912162
SHA512

2327e2e3239b9ba923b0e6e1ccf095147077dbfb44074b6d458c47302fe3a675ebe9158fd2ece35af4b95be3a1194c7cd8109948f748cfe2164fdadf02bf332b
SSDEEP

96:oQsN6Aq7Jvd+J7WDsVFsGWEDU5fHzLtF3O0CCc9wLyEcIkgcwQwTpjTxG:hsN67vd870sViBXlHzLSosaNcIkgUw9E

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2212	4884	WerFault.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4884	rundll32.exe
4884	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4884	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4884	3528	rundll32.exe	94
PID 3528 wrote to memory of 4884	3528	rundll32.exe	94
PID 3528 wrote to memory of 4884	3528	rundll32.exe	94

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba217274423d9eefdc52bdec19dc38cb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba217274423d9eefdc52bdec19dc38cb.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 632
    3⤵
    - Program crash
    PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4884 -ip 4884
1⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2524 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4884-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4884-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download