Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 20:02
Behavioral task
behavioral1
Sample
3034678838c9841ced0b964a43fba32c1f2cf338555b88c57904730e352def8a.dll
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
General
-
Target
3034678838c9841ced0b964a43fba32c1f2cf338555b88c57904730e352def8a.dll
-
Size
68KB
-
MD5
b9a8d2771ef9248c419838151fe59dbe
-
SHA1
cc05f03be9046495afd8ab83956238c84c6178b1
-
SHA256
3034678838c9841ced0b964a43fba32c1f2cf338555b88c57904730e352def8a
-
SHA512
94f3a00b69b95ebb1937efbf0e066dd66fd972b6435c3fc896cef17408176faf0aba76a743efe00e4c90588fb45de01f3b3a77b51c65f3bcfcd921719d9d889b
-
SSDEEP
1536:MLNd/Pk7btaoX7DypKr0wNCYIUSS9eyBEm0iZs3z:GNhY5aora80mCYI7jmXs3
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ttwpafyq.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2064 2984 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1148 wrote to memory of 2984 1148 rundll32.exe rundll32.exe PID 1148 wrote to memory of 2984 1148 rundll32.exe rundll32.exe PID 1148 wrote to memory of 2984 1148 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3034678838c9841ced0b964a43fba32c1f2cf338555b88c57904730e352def8a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3034678838c9841ced0b964a43fba32c1f2cf338555b88c57904730e352def8a.dll,#12⤵
- Drops startup file
PID:2984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 6243⤵
- Program crash
PID:2064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2984 -ip 29841⤵PID:4644
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2984-0-0x0000000010000000-0x0000000010014000-memory.dmpFilesize
80KB