09f4d95cb63b12ed599a10b2c696185205c5b25db17e080e34551482f0d7d323

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09f4d95cb63b12ed599a10b2c696185205c5b25db17e080e34551482f0d7d323.dll
Size 512KB
Sample240604-w4ktrsfd4v
SHA256 09f4d95cb63b12ed599a10b2c696185205c5b25db17e080e34551482f0d7d323
MD5 bf9b27f8960bb07634f3643bc6a5ce26
SHA1 d6355664e117baa69a816cd39360542cfa0e3df4
SHA512 df96fd471af47e66358bbea935dd3e789e6bc71e87b9798d29ddfbeb2c128e29853b2b89c5e060b24ad69e343932f65b92fabd0c3295c323a561485ccd7fe542
SSDEEP 12288:JGy4ZRxlsgwvkruUMDtmF7dCLftPEXL0BiDK:Avxls/vkruUMDIF7qm5K
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/4944-1-0x000000007C340000-0x000000007C3C1000-memory.dmp	UPX
behavioral2/files/0x0008000000022f51-3.dat	UPX
behavioral2/memory/752-5-0x0000000000400000-0x000000000046C000-memory.dmp	UPX
behavioral2/memory/752-8-0x0000000000400000-0x000000000046C000-memory.dmp	UPX
behavioral2/memory/4944-9-0x000000007C340000-0x000000007C3C1000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
752	rundll32mgr.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000022f51-3.dat	upx
behavioral2/memory/752-5-0x0000000000400000-0x000000000046C000-memory.dmp	upx
behavioral2/memory/752-8-0x0000000000400000-0x000000000046C000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2900	752	WerFault.exe	83
1656	4944	WerFault.exe	82

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4944	3708	rundll32.exe	82
PID 3708 wrote to memory of 4944	3708	rundll32.exe	82
PID 3708 wrote to memory of 4944	3708	rundll32.exe	82
PID 4944 wrote to memory of 752	4944	rundll32.exe	83
PID 4944 wrote to memory of 752	4944	rundll32.exe	83
PID 4944 wrote to memory of 752	4944	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09f4d95cb63b12ed599a10b2c696185205c5b25db17e080e34551482f0d7d323.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\09f4d95cb63b12ed599a10b2c696185205c5b25db17e080e34551482f0d7d323.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    PID:752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 264
      4⤵
      Program crash
      PID:2900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4944 -s 608
    3⤵
    - Program crash
    PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4944 -ip 4944
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 752 -ip 752
1⤵
PID:4024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

rundll32mgr.exe

Path C:\Windows\SysWOW64\rundll32mgr.exe
Size 173KB
SHA256 322b8fe73a8f4d60627aac70bad1e724e2a8e4b605ac3b1cec96cd9029591825
MD5 368c6653018fffc8902b3404f1330c5f
SHA1 11222508abc7a16e6d5004b92645c22173bd805c
SHA512 108afbb6af60e2fd445cc9494b901b604ec353b39c1d6e36a47f27a877d0696241b128134c4471c22f94bde2adffab0efb871b80708369412d9179f3b672a756
SSDEEP 1536:NOC0FvV4OguHxjhpA4Bm7uW0vSUsghQevBFkutIbgTuFqKRr0aF5frleGhd9TfBi:NwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/752-5-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/752-6-0x0000000000590000-0x0000000000591000-memory.dmp

Download

memory/752-8-0x0000000000400000-0x000000000046C000-memory.dmp

Download

memory/4944-1-0x000000007C340000-0x000000007C3C1000-memory.dmp

Download

memory/4944-9-0x000000007C340000-0x000000007C3C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads