Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 00:32
Static task
static1
Behavioral task
behavioral1
Sample
ac494205f38dc31a976d8d5e5e055a27e634625b9cf95d046ad0bf18f9a443b2N.dll
Resource
win7-20240903-en
General
-
Target
ac494205f38dc31a976d8d5e5e055a27e634625b9cf95d046ad0bf18f9a443b2N.dll
-
Size
140KB
-
MD5
81bbdaf7d1a9102e7dc6b07c99aae9a0
-
SHA1
f47d1b65a127de229f283e5d4df17b4557b08682
-
SHA256
ac494205f38dc31a976d8d5e5e055a27e634625b9cf95d046ad0bf18f9a443b2
-
SHA512
04bf1bb3aedc12900f00736f56dbe647407b1b375413cfebd8b449c9c02bc05ccd74e6c391e5ddc3d405fb07be56f2dacc7992aa202deed3c01faaca6845c3dd
-
SSDEEP
3072:68t1Ohg3RWQZh5zPIHVyDvhmCyaenWVo/estel5XkATa/hG:omRWQn5zaVQVenWVoWsIr6G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
rundll32mgr.exepid process 2228 rundll32mgr.exe -
Loads dropped DLL 9 IoCs
Processes:
rundll32.exeWerFault.exepid process 2492 rundll32.exe 2492 rundll32.exe 2084 WerFault.exe 2084 WerFault.exe 2084 WerFault.exe 2084 WerFault.exe 2084 WerFault.exe 2084 WerFault.exe 2084 WerFault.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2084 2228 WerFault.exe rundll32mgr.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rundll32.exerundll32mgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
rundll32.exerundll32.exerundll32mgr.exedescription pid process target process PID 2452 wrote to memory of 2492 2452 rundll32.exe rundll32.exe PID 2452 wrote to memory of 2492 2452 rundll32.exe rundll32.exe PID 2452 wrote to memory of 2492 2452 rundll32.exe rundll32.exe PID 2452 wrote to memory of 2492 2452 rundll32.exe rundll32.exe PID 2452 wrote to memory of 2492 2452 rundll32.exe rundll32.exe PID 2452 wrote to memory of 2492 2452 rundll32.exe rundll32.exe PID 2452 wrote to memory of 2492 2452 rundll32.exe rundll32.exe PID 2492 wrote to memory of 2228 2492 rundll32.exe rundll32mgr.exe PID 2492 wrote to memory of 2228 2492 rundll32.exe rundll32mgr.exe PID 2492 wrote to memory of 2228 2492 rundll32.exe rundll32mgr.exe PID 2492 wrote to memory of 2228 2492 rundll32.exe rundll32mgr.exe PID 2228 wrote to memory of 2084 2228 rundll32mgr.exe WerFault.exe PID 2228 wrote to memory of 2084 2228 rundll32mgr.exe WerFault.exe PID 2228 wrote to memory of 2084 2228 rundll32mgr.exe WerFault.exe PID 2228 wrote to memory of 2084 2228 rundll32mgr.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac494205f38dc31a976d8d5e5e055a27e634625b9cf95d046ad0bf18f9a443b2N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ac494205f38dc31a976d8d5e5e055a27e634625b9cf95d046ad0bf18f9a443b2N.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1004⤵
- Loads dropped DLL
- Program crash
PID:2084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156