7bf063e66c7e5f500d88292ac613173c25a05a3f53a9a01feb01497777f99e9c

Analysis

Target

7bf063e66c7e5f500d88292ac613173c25a05a3f53a9a01feb01497777f99e9c.dll
Size

243KB
MD5

a0201df4c43b3dbb5966a1c41d261b84
SHA1

6865fcaed6f5f95197a194ab53cfbfef6348dc72
SHA256

7bf063e66c7e5f500d88292ac613173c25a05a3f53a9a01feb01497777f99e9c
SHA512

7fa2dad0e233472689178d746c77985b2c621a3cd019928d7fcc4efb77666aab4de681021d5aa85bd4fca50e4ad508310b3aaa5017aa27f4368064cac6b262a5

Score

8^/10

discovery

Blacklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

5 1860 rundll32.exe
6 1860 rundll32.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

flow	pid	process
5	1860	rundll32.exe
6	1860	rundll32.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1688 wrote to memory of 1860	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 1860	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 1860	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 1860	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 1860	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 1860	1688	rundll32.exe	rundll32.exe
PID 1688 wrote to memory of 1860	1688	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bf063e66c7e5f500d88292ac613173c25a05a3f53a9a01feb01497777f99e9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1656-1-0x000007FEF7080000-0x000007FEF72FA000-memory.dmp

Filesize
2.5MB

Download
memory/1860-0-0x0000000000000000-mapping.dmp

Download