Analysis
-
max time kernel
96s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 07:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5eb4498bc6bd9c2e60c56adc4642a40N.dll
Resource
win7-20240704-en
windows7-x64
8 signatures
120 seconds
General
-
Target
a5eb4498bc6bd9c2e60c56adc4642a40N.dll
-
Size
239KB
-
MD5
a5eb4498bc6bd9c2e60c56adc4642a40
-
SHA1
4561ea195aeec468243918eee92171cde72854a3
-
SHA256
f39996733cdab95af610a517e96147f4f34c657b6ff55e2e27f9dcb91e599d3a
-
SHA512
69a209d984895ad10f2924173b35e62c614ba1eacfcc5ef728f15fc741d86c397832fffff9c9845908a30828b6bdfef3adf26ffc9a745c00c3a480f02bc87c4f
-
SSDEEP
6144:q7gMPBCqsXGOOPzlX9ee5W09Wvj/Dng+X5Cjz0eUR:czsg+9v3gQ55em
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2692 6806.tmp -
Loads dropped DLL 2 IoCs
pid Process 2816 rundll32.exe 2816 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dplaysvr.exe 6806.tmp File created C:\Windows\SysWOW64\mspbde40.dll 6806.tmp File created C:\Windows\SysWOW64\msrd2x40.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\VBAME.DLL 6806.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atidxx32.dll 6806.tmp File created C:\Windows\SysWOW64\dplayx.dll 6806.tmp File created C:\Windows\SysWOW64\mfc40.dll 6806.tmp File created C:\Windows\SysWOW64\setupSNK.exe 6806.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\amdpcom32.dll 6806.tmp File created C:\Windows\SysWOW64\InstallShield\setup.exe 6806.tmp File created C:\Windows\SysWOW64\d3d8.dll 6806.tmp File created C:\Windows\SysWOW64\d3dim.dll 6806.tmp File created C:\Windows\SysWOW64\sqlunirl.dll 6806.tmp File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 6806.tmp File opened for modification C:\Windows\SysWOW64\msvcr120_clr0400.dll 6806.tmp File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\nvd3dum.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\atl100.dll 6806.tmp File created C:\Windows\SysWOW64\mfc40u.dll 6806.tmp File created C:\Windows\SysWOW64\msltus40.dll 6806.tmp File created C:\Windows\SysWOW64\msrepl40.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\msvcr120.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\atl110.dll 6806.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igdumd32.dll 6806.tmp File created C:\Windows\SysWOW64\dpwsockx.dll 6806.tmp File created C:\Windows\SysWOW64\ir32_32.dll 6806.tmp File created C:\Windows\SysWOW64\mstext40.dll 6806.tmp File created C:\Windows\SysWOW64\odbcjt32.dll 6806.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdva.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\FM20.DLL 6806.tmp File opened for modification C:\Windows\SysWOW64\mfc100.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\mfc100u.dll 6806.tmp File created C:\Windows\SysWOW64\msrd3x40.dll 6806.tmp File created C:\Windows\SysWOW64\msvbvm60.dll 6806.tmp File created C:\Windows\SysWOW64\ivfsrc.ax 6806.tmp File opened for modification C:\Windows\SysWOW64\mfc140.dll 6806.tmp File created C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\igd10umd32.dll 6806.tmp File created C:\Windows\SysWOW64\audiodev.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX 6806.tmp File opened for modification C:\Windows\SysWOW64\msvcr110.dll 6806.tmp File created C:\Windows\SysWOW64\msvcrt20.dll 6806.tmp File created C:\Windows\SysWOW64\olecli32.dll 6806.tmp File created C:\Windows\SysWOW64\ir50_32.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\mfc110u.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\vccorlib120.dll 6806.tmp File created C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\atiumdag.dll 6806.tmp File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\MediaPlayer-DLMigPlugin.dll 6806.tmp File created C:\Windows\SysWOW64\d3dim700.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\mfc110.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\mfc120u.dll 6806.tmp File created C:\Windows\SysWOW64\msjet40.dll 6806.tmp File created C:\Windows\SysWOW64\msxbde40.dll 6806.tmp File created C:\Windows\SysWOW64\crtdll.dll 6806.tmp File created C:\Windows\SysWOW64\ir41_32.ax 6806.tmp File created C:\Windows\SysWOW64\regedit.exe 6806.tmp File created C:\Windows\SysWOW64\sqlwoa.dll 6806.tmp File created C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll 6806.tmp File created C:\Windows\SysWOW64\msjtes40.dll 6806.tmp File created C:\Windows\SysWOW64\msorcl32.dll 6806.tmp File created C:\Windows\SysWOW64\msvcr100.dll 6806.tmp File opened for modification C:\Windows\SysWOW64\concrt140.dll 6806.tmp File created C:\Windows\SysWOW64\dmscript.dll 6806.tmp File created C:\Windows\SysWOW64\expsrv.dll 6806.tmp File created C:\Windows\SysWOW64\msexcl40.dll 6806.tmp File created C:\Windows\SysWOW64\msjter40.dll 6806.tmp -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IMPMAIL.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ogalegit.dll 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\PAB.SAM 6806.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordcnv.dll 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPLACE.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCDDSF.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IMCONTACT.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\DLGSETP.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MCPS.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOCFU.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE 6806.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll 6806.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCNPST32.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLMAIL.FAE 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sqlceca35.dll 6806.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup 6806.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\MSOSV.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\RTFHTML.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PNG32.FLT 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSTH7FR.DLL 6806.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MAPIPH.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPCORE.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FPERSON.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPSLAX.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ACT3.SAM 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\xmlrwbin.dll 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EMABLT32.DLL 6806.tmp File opened for modification C:\Program Files\7-Zip\Uninstall.exe 6806.tmp File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\JPEGIM32.FLT 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Help\msitss55.dll 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FBIBLIO.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FREN\MSB1FREN.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PROOF\MSHY7FR.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSO.DLL 6806.tmp File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\PROOF\MSLID.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TextConv\MSCONV97.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OFFXML.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACECORE.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\STSCOPY.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\RICHED20.DLL 6806.tmp File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll 6806.tmp File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 6806.tmp File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGM.dll 6806.tmp -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\Backup\x86_microsoft-windows-riched32_31bf3856ad364e35_6.1.7601.17514_none_9f081dc1e0ddbddb_riched20.dll_fb578f95 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-usp_31bf3856ad364e35_6.1.7601.17514_none_af01e2f9b6be7939_usp10.dll_8785b649 6806.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_gac_x86 6806.tmp File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUi.dll 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-htmlhelp-infotech_31bf3856ad364e35_6.1.7601.17514_none_f8ab56ff71fc562a_itss.dll_f5d929eb 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-international-core_31bf3856ad364e35_6.1.7601.17514_none_ebb1ce7438031941_muiunattend.exe_1e11bb40 6806.tmp File created C:\Windows\winsxs\amd64_igdlh.inf_31bf3856ad364e35_6.1.7600.16385_none_f3e7064ea3c09a9a\igdumd32.dll 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13_wininit.exe_7a527f28 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_6.1.7601.17514_none_f59e20ddece8f922_certenrollctrl.exe_9495aa75 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\FileTracker.dll 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordbi.dll 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationHost_v0400.dll 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..unterinfrastructure_31bf3856ad364e35_6.1.7601.17514_none_da00ad1949e715ad_cntrtextmig.dll_08675f2d 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-rasrtutils_31bf3856ad364e35_6.1.7601.17514_none_0f1cfdfc48bca8a8_rtutils.dll_243724ab 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsecimpl.dll 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-gdi32_31bf3856ad364e35_6.1.7601.17514_none_c1f959bd9451d7a7_gdi32.dll_1f014d57 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-uiribbon_31bf3856ad364e35_6.1.7601.17514_none_db578bdb5e3559c6_uiribbon.dll_8a707982 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.1.7601.17514_none_5d772bc73c15dfe5_crypt32.dll_9c3ccf73 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-legacyhwui_31bf3856ad364e35_6.1.7600.16385_none_e24a7886a9947ebf_hdwwiz.exe_b6a1c2df 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_ndadmin.exe_8e57269f 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-duser_31bf3856ad364e35_6.1.7600.16385_none_5a4b046c5dce176a_duser.dll_a2bd2fa9 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-shlwapi_31bf3856ad364e35_6.1.7601.17514_none_fbe11bf002f10455_shlwapi.dll_1eec0a2e 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AdoNetDiag.dll 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\MmcAspExt.dll 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-explorerframe_31bf3856ad364e35_6.1.7601.17514_none_2af7b924bed13316_explorerframe.dll_f3ae0f78 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-dui70_31bf3856ad364e35_6.1.7600.16385_none_578b05f45f6e5c68_dui70.dll_5f097b0b 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_04dbf9102154d42e_ddrawex.dll_2aa2f829 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-f..temutilitylibraries_31bf3856ad364e35_6.1.7601.17514_none_eb9dc1c34def72a3_ifsutil.dll_7d6905f6 6806.tmp File created C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll 6806.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100_x86 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-msxml60_31bf3856ad364e35_6.1.7601.17514_none_f0e8ac03e1d6bb5b_msxml6.dll_ebe15265 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-credui_31bf3856ad364e35_6.1.7601.17514_none_dd3eb6aced2f8d13_credui.dll_c0e5bbea 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-cryptui-dll_31bf3856ad364e35_6.1.7601.17514_none_87f5c549f6656c22_cryptui.dll_af347940 6806.tmp File created C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\wpfgfx_x86.dll 6806.tmp File created C:\Windows\winsxs\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7601.17514_none_03c46b205be81dfd\atidxx32.dll 6806.tmp File created C:\Windows\winsxs\amd64_nv_lh.inf_31bf3856ad364e35_6.1.7600.16385_none_4a5c7d78e486512b\nvd3dum.dll 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-unimodem-config_31bf3856ad364e35_6.1.7600.16385_none_f4d7f7b17ffe522a_modemmigplugin.dll_6b9e1a82 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-wmpdui_31bf3856ad364e35_6.1.7600.16385_none_5ca7e61c63366a5f_wmpdui.dll_ed891d84 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_newdev.exe_7eb73dcd 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfdll.dll 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvc.dll 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\sqmapi.dll 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728_puiobj.dll_343adf45 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-directx-directdraw_31bf3856ad364e35_6.1.7600.16385_none_04dbf9102154d42e_ddraw.dll_8f1f5d02 6806.tmp File created C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100u_x86 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtilLib.dll 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.Activities.Compiler.dll 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-setupapi_31bf3856ad364e35_6.1.7601.17514_none_9d700972113e2691_setupapi.dll_8d9de2e7 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_6.1.7601.17514_none_b7e72625aff23492_winmm.dll_08d4f5e8 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 6806.tmp File created C:\Windows\winsxs\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7601.17514_none_03c46b205be81dfd\atiumdva.dll 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_54d62f663d777131_bcrypt.dll_e2f091ac 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-newdev_31bf3856ad364e35_6.1.7600.16385_none_114ca177b1fcad24_newdev.dll_7eb7622f 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e_scecli.dll_149e0f7b 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-uxtheme_31bf3856ad364e35_6.1.7600.16385_none_0c2e36cd54a163b4_uxtheme.dll_9f6cda06 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-e..estorageengine-isam_31bf3856ad364e35_6.1.7601.17514_none_f3ebb0cc8a4dd814_esent.dll_35f49bdd 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-ldap-client_31bf3856ad364e35_6.1.7601.17514_none_f543b182b4adcce6_wldap32.dll_09c99dc1 6806.tmp File created C:\Windows\winsxs\Backup\x86_microsoft-windows-spp-main_31bf3856ad364e35_6.1.7601.17514_none_e64e60ad0b1ee918_spp.dll_d7bb2b05 6806.tmp File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupEngine.dll 6806.tmp File created C:\Windows\winsxs\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7601.17514_none_03c46b205be81dfd\atiumdag.dll 6806.tmp File created C:\Windows\winsxs\Backup\wow64_microsoft-windows-ole-automation_31bf3856ad364e35_6.1.7601.17514_none_257ada4f467a7f64_oleaut32.dll_730e3d41 6806.tmp -
Program crash 1 IoCs
pid pid_target Process procid_target 2880 2816 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2812 wrote to memory of 2816 2812 rundll32.exe 30 PID 2812 wrote to memory of 2816 2812 rundll32.exe 30 PID 2812 wrote to memory of 2816 2812 rundll32.exe 30 PID 2812 wrote to memory of 2816 2812 rundll32.exe 30 PID 2812 wrote to memory of 2816 2812 rundll32.exe 30 PID 2812 wrote to memory of 2816 2812 rundll32.exe 30 PID 2812 wrote to memory of 2816 2812 rundll32.exe 30 PID 2816 wrote to memory of 2692 2816 rundll32.exe 31 PID 2816 wrote to memory of 2692 2816 rundll32.exe 31 PID 2816 wrote to memory of 2692 2816 rundll32.exe 31 PID 2816 wrote to memory of 2692 2816 rundll32.exe 31 PID 2816 wrote to memory of 2880 2816 rundll32.exe 32 PID 2816 wrote to memory of 2880 2816 rundll32.exe 32 PID 2816 wrote to memory of 2880 2816 rundll32.exe 32 PID 2816 wrote to memory of 2880 2816 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a5eb4498bc6bd9c2e60c56adc4642a40N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a5eb4498bc6bd9c2e60c56adc4642a40N.dll,#12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\6806.tmpC:\Users\Admin\AppData\Local\Temp\6806.tmp3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2692
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 2283⤵
- Program crash
PID:2880
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
145KB
MD5c610e7ccd6859872c585b2a85d7dc992
SHA1362b3d4b72e3add687c209c79b500b7c6a246d46
SHA25614063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041
SHA5128570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666