f51f3c1fb71a3301e0716e9025bc063e8f1aeb7c3b1bb5570f9e159f86eb67be

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12/07/2024, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScanDoc_pdf.exe
Size 296KB
Sample240712-tldxdstalc
SHA256 b1999a87350ef2b15e663c809ac16f2f0832ba3dcd868aefe0d36392af04da29
MD5 de0a385641f08128deab9ec88a298d28
SHA1 5f51c8ce26b59ebed00f23ccc4fe696272a0bf07
SHA512 8d93ba4cb7c68426b4441f2950128646fb136285ef6863f0d0c2e08c368c1174d467937a423946e95b1f5fec6213cf6127c666c143c6d5d77d932e64dd1958b2
SSDEEP 6144:Wx/MriVFI8E0P9Qsa8vJXlPqC8A8e1+uaisJPM:qFo8E0lE8h1CJA8Wai6M
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4484	ScanDoc_pdf.exe
4484	ScanDoc_pdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1144	4484	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4484	ScanDoc_pdf.exe
4484	ScanDoc_pdf.exe
4484	ScanDoc_pdf.exe
4484	ScanDoc_pdf.exe
4484	ScanDoc_pdf.exe
4484	ScanDoc_pdf.exe
4484	ScanDoc_pdf.exe
4484	ScanDoc_pdf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 740	4484	ScanDoc_pdf.exe	84
PID 4484 wrote to memory of 740	4484	ScanDoc_pdf.exe	84
PID 4484 wrote to memory of 740	4484	ScanDoc_pdf.exe	84

C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\ScanDoc_pdf.exe"
  2⤵
  PID:740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 1036
  2⤵
  - Program crash
  PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4484 -ip 4484
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6xvjduoucppa.dll

Path C:\Users\Admin\AppData\Local\Temp\6xvjduoucppa.dll
Size 11KB
SHA256 b574aefc953483b2e57dca1653bfec41d14d0c0d460a0e7e778e943d4a1ce364
MD5 5c05b7632a19f8b04717a76aae9e2659
SHA1 a4b1062e88f9170917ec5a9b251bd739f995c3c8
SHA512 eaef74792c64f675add11a6392e32e2eed47701add80ac9945301324057aa8778e9afbd3588109a578f3da1ff09000b1c80756ab9b7f6c5f5ef27dde7fb531ce
SSDEEP 192:OOM8EnrUm2cHjpMTl+p2/mpnTsaqIT9PzRbRit:7EV2cHjpcT/cnNNbRG
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nse9D89.tmp\System.dll
Size 11KB
SHA256 6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
MD5 fccff8cb7a1067e23fd2e2b63971a8e1
SHA1 30e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA512 f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
SSDEEP 192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4484-9-0x0000000010000000-0x0000000010005000-memory.dmp

Download

memory/4484-10-0x0000000010000000-0x0000000010005000-memory.dmp

Download