3cafa584500cacaedd9f29771969bab7f499b47d1912cfcc03fc58cf662ee545 | Triage

Analysis

max time kernel
147s
max time network
154s
platform
windows10_x64
resource
win10v20210408
submitted
13-07-2021 14:02

Sharing

Report Analysis Logs

General

Target

dll/socks32.dll
Size

13KB
MD5

65c17c463e5b6aa86563ddc2d1cc7d94
SHA1

5d2de9c471fccac50d001ba2ccc9904545b712fd
SHA256

683e6f42222caf44fdc3917be95d55a3f2213c5e3f966e33996ecd1f0743197f
SHA512

b31577aee0c3f40167f9956d09ba9090cc75ac037712daf73528896f067cebdcc5e9bd7be92992ea7169750d4363d572ca87a7a692dcbf0292348c900a09efb8

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 14 IoCs

Processes:

rundll32.exe

flow	pid	process
15	1400	rundll32.exe
16	1400	rundll32.exe
17	1400	rundll32.exe
18	1400	rundll32.exe
20	1400	rundll32.exe
21	1400	rundll32.exe
22	1400	rundll32.exe
23	1400	rundll32.exe
24	1400	rundll32.exe
25	1400	rundll32.exe
26	1400	rundll32.exe
27	1400	rundll32.exe
28	1400	rundll32.exe
29	1400	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 800 wrote to memory of 1400	800	rundll32.exe	rundll32.exe
PID 800 wrote to memory of 1400	800	rundll32.exe	rundll32.exe
PID 800 wrote to memory of 1400	800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\socks32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\dll\socks32.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-114-0x0000000000000000-mapping.dmp

Download