8b4886165e2977c191ba7caa160ef0e54e7dfaa6108bcdb91ad364abc16c7751

Analysis

max time kernel
93s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b4886165e2977c191ba7caa160ef0e54e7dfaa6108bcdb91ad364abc16c7751N.dll
Size

444KB
MD5

b3e8997a3e2919d916930e4121931220
SHA1

3deb3acb590cc1178733f3273682571c271e58e4
SHA256

8b4886165e2977c191ba7caa160ef0e54e7dfaa6108bcdb91ad364abc16c7751
SHA512

579e7d4bf4199841b74fbd37a56bcdd6638233bb5f4cbf55536975f9152e917d4ccaba756c561d788763a95835d066bb8ca1a3c3070cb325135fe9af0f851f32
SSDEEP

12288:KXo450qjYthuCNIm/kqF6a2FjyHIDiAstWeO5xzb6:7/ku6FjyHe5KOP/

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2588	rundll32Srv.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32Srv.exe	rundll32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c000000023b50-2.dat	upx
behavioral2/memory/2588-6-0x0000000000400000-0x0000000000472000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4432	4852	WerFault.exe	83
2708	2588	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32Srv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4852	4692	rundll32.exe	83
PID 4692 wrote to memory of 4852	4692	rundll32.exe	83
PID 4692 wrote to memory of 4852	4692	rundll32.exe	83
PID 4852 wrote to memory of 2588	4852	rundll32.exe	84
PID 4852 wrote to memory of 2588	4852	rundll32.exe	84
PID 4852 wrote to memory of 2588	4852	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b4886165e2977c191ba7caa160ef0e54e7dfaa6108bcdb91ad364abc16c7751N.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8b4886165e2977c191ba7caa160ef0e54e7dfaa6108bcdb91ad364abc16c7751N.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\SysWOW64\rundll32Srv.exe
    C:\Windows\SysWOW64\rundll32Srv.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2588
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 268
      4⤵
      Program crash
      PID:2708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 696
    3⤵
    - Program crash
    PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4852 -ip 4852
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2588 -ip 2588
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32Srv.exe

Filesize
67KB

MD5
ce9076b388d0d859a1dbedb92c00f876

SHA1
0f1a621d667f851a81c25f1adba89f3872ac6eeb

SHA256
32c21048d6c384be965ca83d554fb142ea0ca798cc1a552f8e800e75aae142f6

SHA512
f52a96c155047fb4cea09f8c6d44db8e0bb267c7829812eefe126d787f3197ed27f45d48eff440d8f9dacf71cd518667064f59bf334f2c871f88354ca60ad293

Download Submit
memory/2588-6-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/2588-5-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/4852-4-0x0000000010000000-0x00000000126A7000-memory.dmp

Filesize
38.7MB

Download
memory/4852-8-0x0000000010000000-0x00000000126A7000-memory.dmp

Filesize
38.7MB

Download