Analysis

  • max time kernel
    1s
  • max time network
    29s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    19-10-2021 15:23

General

  • Target

    dbl_2.dll

  • Size

    48KB

  • MD5

    12fbfb7de96e3279967af014a3e34bff

  • SHA1

    72d1c283e61a93a611ca0dbe22258f292e38a293

  • SHA256

    86de4f80023bdb799ab028b740ebf2f2d02f4a8d2aad47d93605920af15e41b6

  • SHA512

    ec07611440ab2e219f659ee04d14d1c5f491eaa87e25cdbfb4de8fb050f30194624140bb242133942ca7c1c7574856cff79eacf7a3b5df865d720713e5bc5b5a

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbl_2.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1696 -s 56
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1776-54-0x0000000000000000-mapping.dmp

  • memory/1776-55-0x000007FEFB951000-0x000007FEFB953000-memory.dmp

    Filesize

    8KB

  • memory/1776-56-0x0000000001C20000-0x0000000001C21000-memory.dmp

    Filesize

    4KB