squirrelwaffle | ca8b17eb7317544f922f7e63b8b158c85ce0937841a83ccdd70ffd8e36acf940

Analysis

Target
ca8b17eb7317544f922f7e63b8b158c85ce0937841a83ccdd70ffd8e36acf940.dll
Size 199KB
Sample220121-25f5vscch5
SHA256 ca8b17eb7317544f922f7e63b8b158c85ce0937841a83ccdd70ffd8e36acf940
MD5 fbe46a3e555a2fbfbdb3186ec9321c78
SHA1 bab9fc71655a4b8ca329b1147adbe3e42ec3677e
SHA512 8e1da6113a061e9a10a32a4ad019799865c61e7026d9be7ee8802288a9c3e9ec6b01dc06e16f94a71a5f8f8cd42bca939a4e2cc66dada15ff5e1056e0e23f54b
MD5 SHA1 SHA512

Score

10^/10

Family

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle

Squirrelwaffle Payload 1 IoCs

resource	yara_rule
behavioral2/memory/352-116-0x0000000010000000-0x0000000014030000-memory.dmp	squirrelwaffle

Blocklisted process makes network request 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 352	2760	rundll32.exe	68
PID 2760 wrote to memory of 352	2760	rundll32.exe	68
PID 2760 wrote to memory of 352	2760	rundll32.exe	68

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca8b17eb7317544f922f7e63b8b158c85ce0937841a83ccdd70ffd8e36acf940.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ca8b17eb7317544f922f7e63b8b158c85ce0937841a83ccdd70ffd8e36acf940.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:352

memory/352-115-0x0000000004B80000-0x0000000008B9A000-memory.dmp

Download

memory/352-116-0x0000000010000000-0x0000000014030000-memory.dmp

Download