b8c8e5de1bb47e9874b6cba5723642b65f1f36cbf21b51c9d266e5a786e58c5f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1ef0f926c622e2302786246cc70bfdb.dll
Size 991KB
Sample240319-ebk6dsge96
SHA256 b8c8e5de1bb47e9874b6cba5723642b65f1f36cbf21b51c9d266e5a786e58c5f
MD5 d1ef0f926c622e2302786246cc70bfdb
SHA1 3db925e4cf140663f423150a62457e91290fece2
SHA512 3035bb19e36a9d1df0db3deeb07e9b4c8a8de504d2651c0f55e44f20dc7b31235c2d29d6a302dbb1a64044063cb72deb85044a2936c1728c261b66bd486aaa4f
SSDEEP 24576:PL5/rmRsmDWDPNuFhPvYrpLYHSfcoopooLY9Nu0/c4/RT:lK5hPILYHSfeY9n/D/d
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4828	rundll32mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001000000002315d-3.dat	upx
behavioral2/memory/4828-5-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/4828-7-0x0000000000400000-0x0000000000478000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2240	4828	WerFault.exe	90

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1904	1488	rundll32.exe	89
PID 1488 wrote to memory of 1904	1488	rundll32.exe	89
PID 1488 wrote to memory of 1904	1488	rundll32.exe	89
PID 1904 wrote to memory of 4828	1904	rundll32.exe	90
PID 1904 wrote to memory of 4828	1904	rundll32.exe	90
PID 1904 wrote to memory of 4828	1904	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1ef0f926c622e2302786246cc70bfdb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1ef0f926c622e2302786246cc70bfdb.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:4828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 264
      4⤵
      Program crash
      PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4828 -ip 4828
1⤵
PID:4884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

rundll32mgr.exe

Path C:\Windows\SysWOW64\rundll32mgr.exe
Size 221KB
SHA256 fd0f984f320a0422206c370fbc00c2e931bb9236d2ae36c4f9a968fc9241571a
MD5 e70ecf2fa14973e7c61384fd7dc5c4e9
SHA1 b284f9366cee9e961d9ee3be9148a87a5d2ed7f1
SHA512 563f7501121a16cd24a67443a919afdf4d011e930fea2719418919b9b1b1e30620d63d83954f8427899628a7023521a69cbae20597258f7654647c987c0a9aef
SSDEEP 1536:8OC0FvV4OguHxjhpA4Bm7uW0vSUsghQevBFkutIbgTuFqKRr0aF5frleGhd9TfBi:8wV4OgSzBmh04eZFkz3Rr0gwGj9Tf8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1904-0-0x00000000749B0000-0x0000000074AAB000-memory.dmp

Download

memory/4828-5-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4828-6-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/4828-7-0x0000000000400000-0x0000000000478000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads