Analysis
-
max time kernel
133s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 02:44
Behavioral task
behavioral1
Sample
c4d2d0cca20215f840023a09b10892084f8621a535392dfe1bec341fe363373e.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
-
Target
c4d2d0cca20215f840023a09b10892084f8621a535392dfe1bec341fe363373e.dll
-
Size
38KB
-
MD5
94f2cece4f786f30ecae38858c2b8e60
-
SHA1
824177f62ac0275f32f8d5ef4777d2cee666cfaa
-
SHA256
c4d2d0cca20215f840023a09b10892084f8621a535392dfe1bec341fe363373e
-
SHA512
39891f68c0e441f9d883c1e7c3323315b83a6c647c61f65806676bfb2f97816533cc2a0ddbbdb11d5b694d0d3341eef1172cf9313c2b32d8999bf99e45fd276e
-
SSDEEP
768:Bs+/gMsLIn/wIj2labk+1IsceGSnkmJ0Yblr583CJrVV7isXU76m2sYXVV:WD8w22laSR0V+3CJrVVXczJY
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\dmlconf.dat rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3452 3396 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 3496 wrote to memory of 3396 3496 rundll32.exe rundll32.exe PID 3496 wrote to memory of 3396 3496 rundll32.exe rundll32.exe PID 3496 wrote to memory of 3396 3496 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4d2d0cca20215f840023a09b10892084f8621a535392dfe1bec341fe363373e.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4d2d0cca20215f840023a09b10892084f8621a535392dfe1bec341fe363373e.dll,#12⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 6203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3396 -ip 33961⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3396-0-0x0000000010000000-0x000000001000D000-memory.dmpFilesize
52KB