Analysis
-
max time kernel
93s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 02:33
Static task
static1
Behavioral task
behavioral1
Sample
712880e6000392edbe9045cbbd033f22764526206900c89bfa183fee451e8284N.dll
Resource
win7-20240903-en
General
-
Target
712880e6000392edbe9045cbbd033f22764526206900c89bfa183fee451e8284N.dll
-
Size
188KB
-
MD5
d5400a1109bd37fdd4e2ed5b846ab410
-
SHA1
f6697d9ff80404a371e14fb85cf8532c8d66378d
-
SHA256
712880e6000392edbe9045cbbd033f22764526206900c89bfa183fee451e8284
-
SHA512
b7b0d1dc6dd8df93e61fdf6c7cbefef6e89e3b96176bc7f89d63026c8f29f3c6c7465e423b18a023402c51128f0071ed85fad26e444bb08ab59939593af9861a
-
SSDEEP
3072:RyxAfJTYCfDuoocFHGTuXHHetkqcqvnhzdui:AxgdYAxATuXHHel/Vgi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4800 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/files/0x0009000000023cc7-3.dat upx behavioral2/memory/4800-4-0x0000000000400000-0x000000000045B000-memory.dmp upx behavioral2/memory/4800-8-0x0000000000400000-0x000000000045B000-memory.dmp upx -
Program crash 2 IoCs
pid pid_target Process procid_target 4940 4840 WerFault.exe 84 3784 4800 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3800 wrote to memory of 4840 3800 rundll32.exe 84 PID 3800 wrote to memory of 4840 3800 rundll32.exe 84 PID 3800 wrote to memory of 4840 3800 rundll32.exe 84 PID 4840 wrote to memory of 4800 4840 rundll32.exe 85 PID 4840 wrote to memory of 4800 4840 rundll32.exe 85 PID 4840 wrote to memory of 4800 4840 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\712880e6000392edbe9045cbbd033f22764526206900c89bfa183fee451e8284N.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\712880e6000392edbe9045cbbd033f22764526206900c89bfa183fee451e8284N.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 2644⤵
- Program crash
PID:3784
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 6203⤵
- Program crash
PID:4940
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4840 -ip 48401⤵PID:4748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4800 -ip 48001⤵PID:1252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD5dfb5daabb95dcfad1a5faf9ab1437076
SHA14a199569a9b52911bee7fb19ab80570cc5ff9ed1
SHA25654282ec29d4993ed6e9972122cfbb70bba4898a21d527bd9e72a166d7ec2fdc0
SHA5125d31c34403ab5f8db4a6d84f2b5579d4ea18673914b626d78e458a648ac20ddd8e342818e807331036d7bb064f596a02b9737acac42fbead29260343a30717e8