967d4ab2c6345e193fe61eda3a03ce2ce46fc50bb645c7e28d942de477ac1713

Analysis

max time kernel
132s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 00:52

Target
967d4ab2c6345e193fe61eda3a03ce2ce46fc50bb645c7e28d942de477ac1713.dll
Size 76KB
Sample240526-a77xtagf9v
SHA256 967d4ab2c6345e193fe61eda3a03ce2ce46fc50bb645c7e28d942de477ac1713
MD5 1104ed9e5cb066479a04b08cc19b6402
SHA1 371ac2ae171bccad5891fa5a5bade34ff5a6d083
SHA512 0196572cc617e987644f34974fff9ffce8b4240f5731eefce2d0fe62249f0c4ac6587a9cbba1db70beb4a791e6133a8839eb719c0a2e2d3ea6a9d67b7af4a8a8
SSDEEP 1536:bZZZZZZZZZZZZJmUDlwUSPsx/SxWcTSdBgmK+MqqU+2bbbAV2/S2TOKUU:Nlxwsx89TSdBgMMqqDL2/TOK
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wixqcqlbqha = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\rpeyhh.exe\""	rundll32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5108	4884	WerFault.exe	91

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4884	5112	rundll32.exe	91
PID 5112 wrote to memory of 4884	5112	rundll32.exe	91
PID 5112 wrote to memory of 4884	5112	rundll32.exe	91

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\967d4ab2c6345e193fe61eda3a03ce2ce46fc50bb645c7e28d942de477ac1713.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\967d4ab2c6345e193fe61eda3a03ce2ce46fc50bb645c7e28d942de477ac1713.dll,#1
  2⤵
  - Adds Run key to start application
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 692
    3⤵
    - Program crash
    PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4884 -ip 4884
1⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5164 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:1976