Analysis

  • max time kernel
    91s
  • max time network
    92s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-04-2024 07:29

General

  • Target

    $PLUGINSDIR/olldmhffoaz.dll

  • Size

    22KB

  • MD5

    374e00e1b931d7e06c74d4ce9c9476a3

  • SHA1

    5f199903f9b64b10e218b4d98621f7c2b02b11d9

  • SHA256

    80f175c88444e4c1388bdc3560f9c44b9fb3a24861f20bbedab4b5dfd69d10ef

  • SHA512

    470793bc592c7ec78cc1dec91ebe48d6136c60d179512782b8b41532d372a8293c53913653931b3c74d1544fb038e1fc649cac745bd65310c1ffc88606350ad4

  • SSDEEP

    384:4nMclcY5oSkzLuF1L0hF2IQwAtTbGB1jMbo:4Mc+YSSkzLuFZkw9w+fGBZO

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\olldmhffoaz.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3708
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\olldmhffoaz.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2236
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\olldmhffoaz.dll,#1
        3⤵
          PID:4916
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 716
          3⤵
          • Program crash
          PID:4804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2236 -ip 2236
      1⤵
        PID:4888

      Network

      • flag-us
        DNS
        133.211.185.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.211.185.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        107.211.222.173.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        107.211.222.173.in-addr.arpa
        IN PTR
        Response
        107.211.222.173.in-addr.arpa
        IN PTR
        a173-222-211-107deploystaticakamaitechnologiescom
      • flag-us
        DNS
        134.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        134.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        79.121.231.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        79.121.231.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        97.17.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        97.17.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        157.123.68.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        157.123.68.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        217.135.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.135.221.88.in-addr.arpa
        IN PTR
        Response
        217.135.221.88.in-addr.arpa
        IN PTR
        a88-221-135-217deploystaticakamaitechnologiescom
      • flag-us
        DNS
        152.33.115.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        152.33.115.104.in-addr.arpa
        IN PTR
        Response
        152.33.115.104.in-addr.arpa
        IN PTR
        a104-115-33-152deploystaticakamaitechnologiescom
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      No results found
      • 8.8.8.8:53
        133.211.185.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        133.211.185.52.in-addr.arpa

      • 8.8.8.8:53
        107.211.222.173.in-addr.arpa
        dns
        74 B
        141 B
        1
        1

        DNS Request

        107.211.222.173.in-addr.arpa

      • 8.8.8.8:53
        134.32.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        134.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        79.121.231.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        79.121.231.20.in-addr.arpa

      • 8.8.8.8:53
        97.17.167.52.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        97.17.167.52.in-addr.arpa

      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 8.8.8.8:53
        157.123.68.40.in-addr.arpa
        dns
        72 B
        146 B
        1
        1

        DNS Request

        157.123.68.40.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        217.135.221.88.in-addr.arpa
        dns
        73 B
        139 B
        1
        1

        DNS Request

        217.135.221.88.in-addr.arpa

      • 8.8.8.8:53
        152.33.115.104.in-addr.arpa
        dns
        73 B
        139 B
        1
        1

        DNS Request

        152.33.115.104.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2236-0-0x0000000010000000-0x0000000010009000-memory.dmp

        Filesize

        36KB

      • memory/2236-1-0x0000000010000000-0x0000000010009000-memory.dmp

        Filesize

        36KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.