Analysis
-
max time kernel
134s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 03:30
Behavioral task
behavioral1
Sample
d620e2cd5772dcf7c0183f67e02517363c0adc6662f1412ada362c446f4dee2c.dll
Resource
win7-20240221-en
3 signatures
150 seconds
General
-
Target
d620e2cd5772dcf7c0183f67e02517363c0adc6662f1412ada362c446f4dee2c.dll
-
Size
68KB
-
MD5
6ac6ec6d1181f9c5d1fd5918672c908a
-
SHA1
5b4de7de19c9c2ecaa64ec19f6a8addb7e1ffd14
-
SHA256
d620e2cd5772dcf7c0183f67e02517363c0adc6662f1412ada362c446f4dee2c
-
SHA512
1895855bce51d9cc595f8a337a95c6bc3271bc9d55267ad9122b5ce9515bb93313ff42d1cbd7a979c3c8552becdd73d2c617f1a4d021a1f73b3899b44a8943ac
-
SSDEEP
1536:MLNd/Pk7btaoX7DypKr0wNkYIUSS9eyBhs0iZs3+:GNhY5aora80mkYI7ysXs3
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ltgkfmwf.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1696 4920 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4164 wrote to memory of 4920 4164 rundll32.exe rundll32.exe PID 4164 wrote to memory of 4920 4164 rundll32.exe rundll32.exe PID 4164 wrote to memory of 4920 4164 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d620e2cd5772dcf7c0183f67e02517363c0adc6662f1412ada362c446f4dee2c.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d620e2cd5772dcf7c0183f67e02517363c0adc6662f1412ada362c446f4dee2c.dll,#12⤵
- Drops startup file
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 6363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4920 -ip 49201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4920-0-0x0000000010000000-0x0000000010014000-memory.dmpFilesize
80KB