185e3265432b8cb3a3427ad3781fcd8185c00ab014a7012faf29a13e2b0f252b

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 21:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

185e3265432b8cb3a3427ad3781fcd8185c00ab014a7012faf29a13e2b0f252b.dll
Size

300KB
MD5

d2f61b3e08ca734594ef219faa2f877f
SHA1

4b085e827b687f776939923a8cf6f0098d4873aa
SHA256

185e3265432b8cb3a3427ad3781fcd8185c00ab014a7012faf29a13e2b0f252b
SHA512

9e970e772786c7a59242f40355c7f092f79f5e19817015a0da3a7ab8d963c04999734ed6b3b904b814b1880c3c11b073bf55d0369d7d96b92f3c3d1d8efec879
SSDEEP

6144:jC5GPj038tAgFMJQWN8+nscPcItkN9jrlLr0:hj038t/FMJQWxnQn9jrl/0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1956	rundll32mgr.exe

Loads dropped DLL 2 IoCs

pid	Process
2968	rundll32.exe
2968	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2580	2968	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1956	rundll32mgr.exe

Suspicious behavior: MapViewOfSection 24 IoCs

pid	Process
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe
1956	rundll32mgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1956	rundll32mgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2968	1440	rundll32.exe	28
PID 1440 wrote to memory of 2968	1440	rundll32.exe	28
PID 1440 wrote to memory of 2968	1440	rundll32.exe	28
PID 1440 wrote to memory of 2968	1440	rundll32.exe	28
PID 1440 wrote to memory of 2968	1440	rundll32.exe	28
PID 1440 wrote to memory of 2968	1440	rundll32.exe	28
PID 1440 wrote to memory of 2968	1440	rundll32.exe	28
PID 2968 wrote to memory of 1956	2968	rundll32.exe	29
PID 2968 wrote to memory of 1956	2968	rundll32.exe	29
PID 2968 wrote to memory of 1956	2968	rundll32.exe	29
PID 2968 wrote to memory of 1956	2968	rundll32.exe	29
PID 2968 wrote to memory of 2580	2968	rundll32.exe	30
PID 2968 wrote to memory of 2580	2968	rundll32.exe	30
PID 2968 wrote to memory of 2580	2968	rundll32.exe	30
PID 2968 wrote to memory of 2580	2968	rundll32.exe	30
PID 1956 wrote to memory of 372	1956	rundll32mgr.exe	3
PID 1956 wrote to memory of 372	1956	rundll32mgr.exe	3
PID 1956 wrote to memory of 372	1956	rundll32mgr.exe	3
PID 1956 wrote to memory of 372	1956	rundll32mgr.exe	3
PID 1956 wrote to memory of 372	1956	rundll32mgr.exe	3
PID 1956 wrote to memory of 372	1956	rundll32mgr.exe	3
PID 1956 wrote to memory of 372	1956	rundll32mgr.exe	3
PID 1956 wrote to memory of 384	1956	rundll32mgr.exe	4
PID 1956 wrote to memory of 384	1956	rundll32mgr.exe	4
PID 1956 wrote to memory of 384	1956	rundll32mgr.exe	4
PID 1956 wrote to memory of 384	1956	rundll32mgr.exe	4
PID 1956 wrote to memory of 384	1956	rundll32mgr.exe	4
PID 1956 wrote to memory of 384	1956	rundll32mgr.exe	4
PID 1956 wrote to memory of 384	1956	rundll32mgr.exe	4
PID 1956 wrote to memory of 424	1956	rundll32mgr.exe	5
PID 1956 wrote to memory of 424	1956	rundll32mgr.exe	5
PID 1956 wrote to memory of 424	1956	rundll32mgr.exe	5
PID 1956 wrote to memory of 424	1956	rundll32mgr.exe	5
PID 1956 wrote to memory of 424	1956	rundll32mgr.exe	5
PID 1956 wrote to memory of 424	1956	rundll32mgr.exe	5
PID 1956 wrote to memory of 424	1956	rundll32mgr.exe	5
PID 1956 wrote to memory of 472	1956	rundll32mgr.exe	6
PID 1956 wrote to memory of 472	1956	rundll32mgr.exe	6
PID 1956 wrote to memory of 472	1956	rundll32mgr.exe	6
PID 1956 wrote to memory of 472	1956	rundll32mgr.exe	6
PID 1956 wrote to memory of 472	1956	rundll32mgr.exe	6
PID 1956 wrote to memory of 472	1956	rundll32mgr.exe	6
PID 1956 wrote to memory of 472	1956	rundll32mgr.exe	6
PID 1956 wrote to memory of 480	1956	rundll32mgr.exe	7
PID 1956 wrote to memory of 480	1956	rundll32mgr.exe	7
PID 1956 wrote to memory of 480	1956	rundll32mgr.exe	7
PID 1956 wrote to memory of 480	1956	rundll32mgr.exe	7
PID 1956 wrote to memory of 480	1956	rundll32mgr.exe	7
PID 1956 wrote to memory of 480	1956	rundll32mgr.exe	7
PID 1956 wrote to memory of 480	1956	rundll32mgr.exe	7
PID 1956 wrote to memory of 488	1956	rundll32mgr.exe	8
PID 1956 wrote to memory of 488	1956	rundll32mgr.exe	8
PID 1956 wrote to memory of 488	1956	rundll32mgr.exe	8
PID 1956 wrote to memory of 488	1956	rundll32mgr.exe	8
PID 1956 wrote to memory of 488	1956	rundll32mgr.exe	8
PID 1956 wrote to memory of 488	1956	rundll32mgr.exe	8
PID 1956 wrote to memory of 488	1956	rundll32mgr.exe	8
PID 1956 wrote to memory of 596	1956	rundll32mgr.exe	9
PID 1956 wrote to memory of 596	1956	rundll32mgr.exe	9
PID 1956 wrote to memory of 596	1956	rundll32mgr.exe	9
PID 1956 wrote to memory of 596	1956	rundll32mgr.exe	9
PID 1956 wrote to memory of 596	1956	rundll32mgr.exe	9
PID 1956 wrote to memory of 596	1956	rundll32mgr.exe	9
PID 1956 wrote to memory of 596	1956	rundll32mgr.exe	9

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\services.exe
  C:\Windows\system32\services.exe
  2⤵
  PID:472
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    3⤵
    PID:596
  - - C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      4⤵
      PID:1968
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    3⤵
    PID:680
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    3⤵
    PID:764
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    3⤵
    PID:812
  - - C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      4⤵
      PID:1172
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    3⤵
    PID:856
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService
    3⤵
    PID:972
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    3⤵
    PID:280
- - C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    3⤵
    PID:332
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    3⤵
    PID:1072
- - C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    3⤵
    PID:1096
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    3⤵
    PID:2152
- - C:\Windows\system32\sppsvc.exe
    C:\Windows\system32\sppsvc.exe
    3⤵
    PID:2224
- C:\Windows\system32\lsass.exe
  C:\Windows\system32\lsass.exe
  2⤵
  PID:480
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\185e3265432b8cb3a3427ad3781fcd8185c00ab014a7012faf29a13e2b0f252b.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\185e3265432b8cb3a3427ad3781fcd8185c00ab014a7012faf29a13e2b0f252b.dll,#1
    3⤵
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\SysWOW64\rundll32mgr.exe
      C:\Windows\SysWOW64\rundll32mgr.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1956
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 228
      4⤵
      Program crash
      PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
ced1aea3d11e1b70e6bdfbdf883da0a4

SHA1
818fecc62b7a075cefe9759074464607d6bd52d5

SHA256
6bf976bce174dd23b8f18fe4d20cbe0b78850a8efe998a67da3c72db64b1fe25

SHA512
0a296f949dab703b4d47b12f32fa2ebe17f661c26bd1f73978b34f420046af235e9cc9e86271373bbaa7f772046000bfddeb616064a3f88f294c5e055e67f527

Download Submit
memory/1956-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2580-13-0x0000000077570000-0x0000000077571000-memory.dmp

Filesize
4KB

Download
memory/2580-14-0x000000007756F000-0x0000000077570000-memory.dmp

Filesize
4KB

Download
memory/2580-15-0x000000007EFA0000-0x000000007EFAA000-memory.dmp

Filesize
40KB

Download
memory/2580-17-0x000000007EFA0000-0x000000007EFAA000-memory.dmp

Filesize
40KB

Download
memory/2968-0-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2968-2-0x0000000010000000-0x000000001004F000-memory.dmp

Filesize
316KB

Download
memory/2968-4-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2968-11-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2968-16-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download