Analysis

  • max time kernel
    163s
  • max time network
    163s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    13-11-2021 17:35

General

  • Target

    18cd9e697d749314e471c97e33b821847229c4347fc6f438a5f9d7fa61f6f0dd.dll

  • Size

    52KB

  • MD5

    20de10e77bb365175635770e32fe0e95

  • SHA1

    934d2331b6b1770d8c4fa95e9066a67c2411266c

  • SHA256

    18cd9e697d749314e471c97e33b821847229c4347fc6f438a5f9d7fa61f6f0dd

  • SHA512

    d0cf60988b95797aaeaed077ea8c97ce023056a12c725aa274dadbce1a1c94ba0603c24793c4d708650ccfdbd21c6e2e2af90a8561d5ac7cef1c5eb5da40be19

Score
10/10

Malware Config

Signatures

  • suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

    suricata: ET MALWARE SQUIRRELWAFFLE Loader Activity (POST)

  • Blocklisted process makes network request 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\18cd9e697d749314e471c97e33b821847229c4347fc6f438a5f9d7fa61f6f0dd.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\18cd9e697d749314e471c97e33b821847229c4347fc6f438a5f9d7fa61f6f0dd.dll,#1
      2⤵
      • Blocklisted process makes network request
      PID:1800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads