Analysis

  • max time kernel
    35s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-03-2024 11:55

General

  • Target

    4123.dll

  • Size

    48KB

  • MD5

    f776deb4df137b37dcae5406c8f3a07a

  • SHA1

    f6a31b594fca39c118927405fa4d14353b8fd49a

  • SHA256

    93cc5e6a6b671d9b0124ade32ae8b09269de9f03c5c5e66347fbfc7a8c3b305e

  • SHA512

    4077b4214b4683bb4776d470027e61fcc3cb3e78beb9377674e4a4de9115d52911e39cb29a566ab446c6962a252ce01020ffd616b5854a9d8230414262bfafe2

  • SSDEEP

    768:fw2jnhaqqUgQeONXr27iLAkfP69FyfQZWBS:hjnEQeON727CA2G

Score
10/10

Malware Config

Signatures

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

  • Nloader payload 4 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\4123.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:684
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\4123.dll,#1
      2⤵
        PID:5044
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 912
          3⤵
          • Program crash
          PID:1716
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5044 -ip 5044
      1⤵
        PID:4588

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/5044-3-0x0000000002BB0000-0x0000000002BB9000-memory.dmp

        Filesize

        36KB

      • memory/5044-5-0x0000000001480000-0x0000000001486000-memory.dmp

        Filesize

        24KB

      • memory/5044-8-0x0000000002BC0000-0x0000000002BC7000-memory.dmp

        Filesize

        28KB

      • memory/5044-11-0x0000000002BE0000-0x0000000002BE5000-memory.dmp

        Filesize

        20KB