Analysis
-
max time kernel
25s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 00:45
Static task
static1
Behavioral task
behavioral1
Sample
c45541f52018b31f0801433d725b9ad0ebbf9e118b331f7b8b04fd8a861e306bN.dll
Resource
win7-20240903-en
General
-
Target
c45541f52018b31f0801433d725b9ad0ebbf9e118b331f7b8b04fd8a861e306bN.dll
-
Size
176KB
-
MD5
a62aad50c56e3bff4642322e1fd24210
-
SHA1
3d37f206d0c8a1dec25579ca2a27155e1bafbb6d
-
SHA256
c45541f52018b31f0801433d725b9ad0ebbf9e118b331f7b8b04fd8a861e306b
-
SHA512
bffeb875deee7f478d0c85f7740b301b569423b9acae34ef26a03d862caedd7a5550d8c3e3a7f267fbe3f84d7190cfa9516a2e354a774797acf9d11d195ec4bd
-
SSDEEP
3072:pgKKuiX63bw5dNjDh8pWVgTlFIYnXrWXQOTcowGqdCrfLXGuHH:iKZp3KNjVGvCXJcJRQfCiH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32mgr.exepid process 2844 rundll32mgr.exe -
Loads dropped DLL 9 IoCs
Processes:
rundll32.exeWerFault.exepid process 2940 rundll32.exe 2940 rundll32.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe 2600 WerFault.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2600 2844 WerFault.exe rundll32mgr.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exerundll32mgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exedescription pid process target process PID 2728 wrote to memory of 2940 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2940 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2940 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2940 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2940 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2940 2728 rundll32.exe rundll32.exe PID 2728 wrote to memory of 2940 2728 rundll32.exe rundll32.exe PID 2940 wrote to memory of 2844 2940 rundll32.exe rundll32mgr.exe PID 2940 wrote to memory of 2844 2940 rundll32.exe rundll32mgr.exe PID 2940 wrote to memory of 2844 2940 rundll32.exe rundll32mgr.exe PID 2940 wrote to memory of 2844 2940 rundll32.exe rundll32mgr.exe PID 2844 wrote to memory of 2600 2844 rundll32mgr.exe WerFault.exe PID 2844 wrote to memory of 2600 2844 rundll32mgr.exe WerFault.exe PID 2844 wrote to memory of 2600 2844 rundll32mgr.exe WerFault.exe PID 2844 wrote to memory of 2600 2844 rundll32mgr.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c45541f52018b31f0801433d725b9ad0ebbf9e118b331f7b8b04fd8a861e306bN.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c45541f52018b31f0801433d725b9ad0ebbf9e118b331f7b8b04fd8a861e306bN.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1564⤵
- Loads dropped DLL
- Program crash
PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD50e0f0ae845d89c22bb6385f64a6b85fd
SHA10f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA2565a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
SHA512baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350