Analysis
-
max time kernel
139s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 18:05
Static task
static1
Behavioral task
behavioral1
Sample
007d61bc4a2281337c5b7ea0023f0991bd6b8e6075af75f0f037cb253fc26fb1.dll
Resource
win7-20240221-en
General
-
Target
007d61bc4a2281337c5b7ea0023f0991bd6b8e6075af75f0f037cb253fc26fb1.dll
-
Size
796KB
-
MD5
5ecef65f014eef28fcc71736135f3d75
-
SHA1
4469ad90e3532bdccf9ed049cf55e9f9af3cab00
-
SHA256
007d61bc4a2281337c5b7ea0023f0991bd6b8e6075af75f0f037cb253fc26fb1
-
SHA512
b89795219846a66e677c5e8f5225782785462d36f47a550ba47ed5e4cabae35eade5ec12afa9b8882456e3b130a7786892d082bfb45e493e76e96a982e25ff3a
-
SSDEEP
12288:1e4z4D60MQuPMeS+GSK4OOXsVAwMKz/xh/qu/OmLEtnJmbA8bWbc+SJKFQ7LDi8/:1D+60runS+G7ecVTLEu2hVx/F0i8Aa
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
140D.tmppid process 1716 140D.tmp -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exepid process 1804 rundll32.exe 1804 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
Processes:
140D.tmpdescription ioc process File created C:\Windows\SysWOW64\FXSXP32.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\mfc120.dll 140D.tmp File created C:\Windows\SysWOW64\mfc40.dll 140D.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 140D.tmp File created C:\Windows\SysWOW64\d3dxof.dll 140D.tmp File created C:\Windows\SysWOW64\InstallShield\setup.exe 140D.tmp File created C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll 140D.tmp File created C:\Windows\SysWOW64\d3d8.dll 140D.tmp File created C:\Windows\SysWOW64\regedit.exe 140D.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 140D.tmp File created C:\Windows\SysWOW64\mspbde40.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 140D.tmp File created C:\Windows\SysWOW64\d3dim700.dll 140D.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 140D.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 140D.tmp File created C:\Windows\SysWOW64\msrepl40.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\mfc140u.dll 140D.tmp File created C:\Windows\SysWOW64\iac25_32.ax 140D.tmp File created C:\Windows\SysWOW64\mfc40u.dll 140D.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 140D.tmp File created C:\Windows\SysWOW64\expsrv.dll 140D.tmp File created C:\Windows\SysWOW64\setupSNK.exe 140D.tmp File created C:\Windows\SysWOW64\crtdll.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX 140D.tmp File created C:\Windows\SysWOW64\msrd2x40.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 140D.tmp File created C:\Windows\SysWOW64\olecli32.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\VBAME.DLL 140D.tmp File created C:\Windows\SysWOW64\explorer.exe 140D.tmp File created C:\Windows\SysWOW64\ir32_32.dll 140D.tmp File created C:\Windows\SysWOW64\msjtes40.dll 140D.tmp File created C:\Windows\SysWOW64\mswstr10.dll 140D.tmp File created C:\Windows\SysWOW64\dplayx.dll 140D.tmp File created C:\Windows\SysWOW64\msjet40.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\vcomp140.dll 140D.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 140D.tmp File created C:\Windows\SysWOW64\msltus40.dll 140D.tmp File created C:\Windows\SysWOW64\mstext40.dll 140D.tmp File created C:\Windows\SysWOW64\msvbvm60.dll 140D.tmp File created C:\Windows\SysWOW64\msxbde40.dll 140D.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll 140D.tmp File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 140D.tmp File created C:\Windows\SysWOW64\audiodev.dll 140D.tmp File created C:\Windows\SysWOW64\msexch40.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 140D.tmp File created C:\Windows\SysWOW64\msexcl40.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll 140D.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll 140D.tmp File created C:\Windows\SysWOW64\dplaysvr.exe 140D.tmp File created C:\Windows\SysWOW64\dpwsockx.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\FM20.DLL 140D.tmp File created C:\Windows\SysWOW64\mswdat10.dll 140D.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll 140D.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvwgf2um.dll 140D.tmp File created C:\Windows\SysWOW64\d3dim.dll 140D.tmp File created C:\Windows\SysWOW64\dmscript.dll 140D.tmp File created C:\Windows\SysWOW64\msorcl32.dll 140D.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 140D.tmp File opened for modification C:\Windows\SysWOW64\msvcr120_clr0400.dll 140D.tmp -
Drops file in Program Files directory 64 IoCs
Processes:
140D.tmpdescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7FR.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\weblink.api 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\EPSIMP32.FLT 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IETAG.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VVIEWER.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 140D.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api 140D.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\VBAJET32.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdate.dll 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FSTOCK.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PSTPRX32.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\TWCUTCHR.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\NPSWF32.dll 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\MSCONV97.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OART.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONWordAddin.dll 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SOCIALCONNECTOR.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACER3X.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAME.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia100.dll 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VVIEWDWG.DLL 140D.tmp File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 140D.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll 140D.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\IA32.api 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDS.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EntityPicker.dll 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 140D.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\AiodLite.dll 140D.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll 140D.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\GIFIMP32.FLT 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GKWord.dll 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE 140D.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST64.DLL 140D.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 140D.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XPAGE3C.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSSP7FR.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7EN.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\MSGR3FR.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMSMDB32.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OWSSUPP.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEREP.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1STAR.DLL 140D.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCVDT.DLL 140D.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll 140D.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll 140D.tmp -
Drops file in Windows directory 64 IoCs
Processes:
140D.tmpdescription ioc process File created C:\Windows\winsxs\Backup\x86_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_aaf695e9bb060258_atl.dll_0c7220db 140D.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_abd5b433b8ccf7a4_cmiv2.dll_be06aa9f 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-sysprep_31bf3856ad364e35_8.0.7601.17514_none_3853caf38f4097bb\iesysprep.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-msmpeg2vdec_31bf3856ad364e35_6.1.7600.16385_none_90cd9ae919559d36\msmpeg2vdec.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-systemrestore-srhelper_31bf3856ad364e35_6.1.7600.16385_none_aebaae1fbbd1273c\srhelper.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-com-complus-setup_31bf3856ad364e35_6.1.7600.16385_none_e97e2f6c50a1c3c0\comsetup.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-odbc-installer-dll_31bf3856ad364e35_6.1.7601.17514_none_8f326e5fb376d9c0\odbccp32.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..ponents-jetxbasepdx_31bf3856ad364e35_6.1.7600.16385_none_91e7a2968218eaf7\mspbde40.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\dpx.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-speechengine_31bf3856ad364e35_6.1.7600.16385_none_ee947359fb35d641\spsrx.dll 140D.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.2.9600.16428_none_ffeecffc6b986ebd\mshtml.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_6.1.7601.17514_none_c82fdb5265bc18af\SndVol.exe 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-cryptnet-dll_31bf3856ad364e35_6.1.7600.16385_none_16ef973d5d294eb5\cryptnet.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-efs-core-library_31bf3856ad364e35_6.1.7601.17514_none_58a94d70f5cca7eb\efscore.dll 140D.tmp File created C:\Windows\winsxs\x86_wcf-icardagt_exe_31bf3856ad364e35_6.1.7600.16385_none_31ae00ebd2fb34b5\icardagt.exe 140D.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_c1fead4e4bf85947\IMTCPROP.exe 140D.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_cntrtextmig.dll_08675f2d 140D.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_6.1.7601.17514_none_c1fead4e4bf85947\IMTCCORE.DLL 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d10.1_31bf3856ad364e35_7.1.7601.16492_none_4348f88492fd6ee6\d3d10_1core.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-ieshims_31bf3856ad364e35_11.2.9600.16428_none_cdc5a77ff6e9c343\IEShims.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-networkinspection_31bf3856ad364e35_11.2.9600.16428_none_fb3501f3b0b1621d\networkinspection.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-management-console_31bf3856ad364e35_6.1.7600.16385_none_0f49a133d6f5d42b\cic.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-rasclienttools_31bf3856ad364e35_6.1.7600.16385_none_6f1d25ec0a04d811\rasphone.exe 140D.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 140D.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_0dfae70253a9fb02_authui.dll_05ff9fd2 140D.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-fax-mapi_31bf3856ad364e35_6.1.7600.16385_none_b5e9a074c5f969cd\FXSXP32.dll 140D.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7601.17514_none_227e1c01642654f4\wermgr.exe 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-msvbvm60_31bf3856ad364e35_6.1.7600.16385_none_c25a1af6b30d72ee\msvbvm60.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-photo-printing-wizard_31bf3856ad364e35_6.1.7601.17514_none_56f03a373b53e5ef\photowiz.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_6.1.7600.16385_none_a1802b822e2a878c\WMIC.exe 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_6.1.7600.16385_none_0bfb8f2b539d4d43\AcSpecfc.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_6.1.7600.16385_none_fe75fb7856d846d5\DWWIN.EXE 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-f12tools_31bf3856ad364e35_11.2.9600.16428_none_0f78b652edd1b7a5\F12Tools.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.6161_none_4bf7e3e2bf9ada4c\mfc90.dll 140D.tmp File created C:\Windows\winsxs\x86_netfx-clrgc_b03f5f7f11d50a3a_6.1.7601.17514_none_f5276fe6b5adf276\clrgc.exe 140D.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_ndadmin.exe_8e57269f 140D.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_newdev.dll_7eb7622f 140D.tmp File created C:\Windows\winsxs\wow64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.7601.17514_none_c519dbeb6e585715\winhttp.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_6.1.7601.17514_none_ef38a8d0d05cc2c7\IMJPUEX.EXE 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_1eaaa4a07717236e\jsproxy.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_6.1.7601.17514_none_a2fcd94e8fba36f5\RMActivate.exe 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wpd-legacywmdmapi_31bf3856ad364e35_6.1.7600.16385_none_5980e766d0fe239f\mswmdm.dll 140D.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-oleacc_31bf3856ad364e35_6.1.7600.16385_none_d0ce59c770758425_oleacc.dll_2f3fa5bf 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-a..c-performance-layer_31bf3856ad364e35_6.1.7600.16385_none_100d67cc0062d5b0\dmscript.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..mponents-jetintlerr_31bf3856ad364e35_6.1.7600.16385_none_0f472a3521bdcfd4\mswstr10.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..sor-library-unicode_31bf3856ad364e35_6.1.7600.16385_none_70a8de6befefbaab\odbccu32.dll 140D.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-errorreportingcore_31bf3856ad364e35_6.1.7601.17514_none_227e1c01642654f4_wermgr.exe_d92a3b6c 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-com-dtc-oraclesupport_31bf3856ad364e35_6.1.7600.16385_none_ed468092c9bf2870\mtxoci.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-displayswitch_31bf3856ad364e35_6.1.7600.16385_none_ec98071c85cf09eb\DisplaySwitch.exe 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.2.9600.16428_none_d6876629731ce419\pdm.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.7601.17514_none_0a379bcfbdcffb74\PDMSetup.exe 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..s-mdac-odbcconf-dll_31bf3856ad364e35_6.1.7601.17514_none_09e055945403c2af\odbcconf.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-netjoin_31bf3856ad364e35_6.1.7601.17514_none_5961893bcb092ef4\netjoin.dll 140D.tmp File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\mssitlb.dll 140D.tmp File created C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\SearchIndexer.exe 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-wlan-extension_31bf3856ad364e35_6.1.7600.16385_none_f9b9855184ad1e6d\wlanext.exe 140D.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_6.1.7600.16385_none_963d3becc3a475f1\raserver.exe 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d10.1_31bf3856ad364e35_6.1.7601.17514_none_5230e75107d43005\d3d10_1core.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-m..-components-jet2x3x_31bf3856ad364e35_6.1.7600.16385_none_e77583b71bc39457\msrd2x40.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-s..configurationengine_31bf3856ad364e35_6.1.7601.17514_none_bb2c4d9ee6dcc35c\scesrv.dll 140D.tmp File created C:\Windows\winsxs\x86_microsoft-windows-t..s-collaboration-api_31bf3856ad364e35_6.1.7601.17514_none_47789a25fb881e44\rdpencom.dll 140D.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_73e472e09a1a05d1\wmpshare.exe 140D.tmp File created C:\Windows\winsxs\wow64_microsoft-windows-mediaplayer-drm_31bf3856ad364e35_6.1.7601.17514_none_d6a8cb040fcd3a85\blackbox.dll 140D.tmp -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2868 1804 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 912 wrote to memory of 1804 912 rundll32.exe rundll32.exe PID 912 wrote to memory of 1804 912 rundll32.exe rundll32.exe PID 912 wrote to memory of 1804 912 rundll32.exe rundll32.exe PID 912 wrote to memory of 1804 912 rundll32.exe rundll32.exe PID 912 wrote to memory of 1804 912 rundll32.exe rundll32.exe PID 912 wrote to memory of 1804 912 rundll32.exe rundll32.exe PID 912 wrote to memory of 1804 912 rundll32.exe rundll32.exe PID 1804 wrote to memory of 1716 1804 rundll32.exe 140D.tmp PID 1804 wrote to memory of 1716 1804 rundll32.exe 140D.tmp PID 1804 wrote to memory of 1716 1804 rundll32.exe 140D.tmp PID 1804 wrote to memory of 1716 1804 rundll32.exe 140D.tmp PID 1804 wrote to memory of 2868 1804 rundll32.exe WerFault.exe PID 1804 wrote to memory of 2868 1804 rundll32.exe WerFault.exe PID 1804 wrote to memory of 2868 1804 rundll32.exe WerFault.exe PID 1804 wrote to memory of 2868 1804 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\007d61bc4a2281337c5b7ea0023f0991bd6b8e6075af75f0f037cb253fc26fb1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\007d61bc4a2281337c5b7ea0023f0991bd6b8e6075af75f0f037cb253fc26fb1.dll,#12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\140D.tmpC:\Users\Admin\AppData\Local\Temp\140D.tmp3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 2563⤵
- Program crash
PID:2868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\140D.tmpFilesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666
-
memory/1804-0-0x00000000001D0000-0x0000000000231000-memory.dmpFilesize
388KB
-
memory/1804-1-0x00000000001D0000-0x0000000000231000-memory.dmpFilesize
388KB