7bf063e66c7e5f500d88292ac613173c25a05a3f53a9a01feb01497777f99e9c

Analysis

Target

7bf063e66c7e5f500d88292ac613173c25a05a3f53a9a01feb01497777f99e9c.dll
Size

243KB
MD5

a0201df4c43b3dbb5966a1c41d261b84
SHA1

6865fcaed6f5f95197a194ab53cfbfef6348dc72
SHA256

7bf063e66c7e5f500d88292ac613173c25a05a3f53a9a01feb01497777f99e9c
SHA512

7fa2dad0e233472689178d746c77985b2c621a3cd019928d7fcc4efb77666aab4de681021d5aa85bd4fca50e4ad508310b3aaa5017aa27f4368064cac6b262a5

Score

8^/10

discovery

Blacklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

13 996 rundll32.exe
17 996 rundll32.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

flow	pid	process
13	996	rundll32.exe
17	996	rundll32.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 636 wrote to memory of 996	636	rundll32.exe	rundll32.exe
PID 636 wrote to memory of 996	636	rundll32.exe	rundll32.exe
PID 636 wrote to memory of 996	636	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7bf063e66c7e5f500d88292ac613173c25a05a3f53a9a01feb01497777f99e9c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:636

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact