Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 03:31
Static task
static1
Behavioral task
behavioral1
Sample
d0f205847003aab8bdb5dfc2f138a497ec56a5ab0e184bda67efebaeefa1a862.dll
Resource
win7-20240220-en
General
-
Target
d0f205847003aab8bdb5dfc2f138a497ec56a5ab0e184bda67efebaeefa1a862.dll
-
Size
677KB
-
MD5
a4de91735cad51050bc92815bee5d1aa
-
SHA1
382dcb85639c2c8282780fb2b53f47147bda7005
-
SHA256
d0f205847003aab8bdb5dfc2f138a497ec56a5ab0e184bda67efebaeefa1a862
-
SHA512
e6090d8694c83f9afc333844b74be3572ed8f65229ba980abf85ad4cbffd05cdc94db455656282b45451083e2e5f2d4c399df6ba5409577ad2fe025abe2fc3f3
-
SSDEEP
6144:/NIQzLZN4k3WvmRPLx+xXqOkyWh9ZN/c4bsXdHtVHs7ZYkJH1:/NIyZN4+Wv4PLq6Okrh9ZN/hs9DsdY41
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32mgr.exepid process 2436 rundll32mgr.exe -
Loads dropped DLL 9 IoCs
Processes:
rundll32.exeWerFault.exepid process 2276 rundll32.exe 2276 rundll32.exe 3040 WerFault.exe 3040 WerFault.exe 3040 WerFault.exe 3040 WerFault.exe 3040 WerFault.exe 3040 WerFault.exe 3040 WerFault.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2492 2276 WerFault.exe rundll32.exe 3040 2436 WerFault.exe rundll32mgr.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exedescription pid process target process PID 2908 wrote to memory of 2276 2908 rundll32.exe rundll32.exe PID 2908 wrote to memory of 2276 2908 rundll32.exe rundll32.exe PID 2908 wrote to memory of 2276 2908 rundll32.exe rundll32.exe PID 2908 wrote to memory of 2276 2908 rundll32.exe rundll32.exe PID 2908 wrote to memory of 2276 2908 rundll32.exe rundll32.exe PID 2908 wrote to memory of 2276 2908 rundll32.exe rundll32.exe PID 2908 wrote to memory of 2276 2908 rundll32.exe rundll32.exe PID 2276 wrote to memory of 2436 2276 rundll32.exe rundll32mgr.exe PID 2276 wrote to memory of 2436 2276 rundll32.exe rundll32mgr.exe PID 2276 wrote to memory of 2436 2276 rundll32.exe rundll32mgr.exe PID 2276 wrote to memory of 2436 2276 rundll32.exe rundll32mgr.exe PID 2276 wrote to memory of 2492 2276 rundll32.exe WerFault.exe PID 2276 wrote to memory of 2492 2276 rundll32.exe WerFault.exe PID 2276 wrote to memory of 2492 2276 rundll32.exe WerFault.exe PID 2276 wrote to memory of 2492 2276 rundll32.exe WerFault.exe PID 2436 wrote to memory of 3040 2436 rundll32mgr.exe WerFault.exe PID 2436 wrote to memory of 3040 2436 rundll32mgr.exe WerFault.exe PID 2436 wrote to memory of 3040 2436 rundll32mgr.exe WerFault.exe PID 2436 wrote to memory of 3040 2436 rundll32mgr.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d0f205847003aab8bdb5dfc2f138a497ec56a5ab0e184bda67efebaeefa1a862.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d0f205847003aab8bdb5dfc2f138a497ec56a5ab0e184bda67efebaeefa1a862.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 1004⤵
- Loads dropped DLL
- Program crash
PID:3040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 2243⤵
- Program crash
PID:2492
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD58499caf4ab80f33508daa32513cc1c7e
SHA1d252d6bad7adce4ffe5c2795fb1e5e6fcca7cbd2
SHA25622a4a2fab776db0d00df29a577b354ba8d775c434b1e88ce4835c6f2e5b4cbd1
SHA512cea57e7540550dc1a88933f5e37a473266892a00da754e8d86519cda4a15cde78915cfe619f9b52d48569627ee8fec51eba4b64bf5ca316874c970113e8a0873