049632abd60c5981f9b9dddf1dc8835d7ccb4c8246c5680139b30c3eaebd6ebc

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06/03/2025, 19:28

Target

049632abd60c5981f9b9dddf1dc8835d7ccb4c8246c5680139b30c3eaebd6ebc.dll
Size

137KB
MD5

9e06801630531fa3f45c44ee17eaf565
SHA1

2d0e907320c464b3629f47944d9828a550090c6e
SHA256

049632abd60c5981f9b9dddf1dc8835d7ccb4c8246c5680139b30c3eaebd6ebc
SHA512

e3ebb537ceb53f43f7bd10587ebe35502136c9fb6e1650392b42e7b7f5ff41d068fc1227a16b58bb091a3dff1fcd33e3e8a671204ade007795df3fcb767c624b
SSDEEP

3072:cR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu0:p25GgFny61mraW

Score

8^/10

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

Port Monitors

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\SCSI Port Monitor\Driver = "scsimon.dll"	rundll32.exe

Sets service image path in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Spooler\ImagePath = "Spoolsv.exe"	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	2604	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2604	2348	rundll32.exe	29
PID 2348 wrote to memory of 2604	2348	rundll32.exe	29
PID 2348 wrote to memory of 2604	2348	rundll32.exe	29
PID 2348 wrote to memory of 2604	2348	rundll32.exe	29
PID 2348 wrote to memory of 2604	2348	rundll32.exe	29
PID 2348 wrote to memory of 2604	2348	rundll32.exe	29
PID 2348 wrote to memory of 2604	2348	rundll32.exe	29
PID 2604 wrote to memory of 2572	2604	rundll32.exe	30
PID 2604 wrote to memory of 2572	2604	rundll32.exe	30
PID 2604 wrote to memory of 2572	2604	rundll32.exe	30
PID 2604 wrote to memory of 2572	2604	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\049632abd60c5981f9b9dddf1dc8835d7ccb4c8246c5680139b30c3eaebd6ebc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\049632abd60c5981f9b9dddf1dc8835d7ccb4c8246c5680139b30c3eaebd6ebc.dll,#1
  2⤵
  - Boot or Logon Autostart Execution: Port Monitors
  - Sets service image path in registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 232
    3⤵
    - Program crash
    PID:2572