squirrelwaffle | 67a63fdf13aa81b714cd3513b452afec88671ad5930535a158fa995c116e603b

Analysis

Target
67a63fdf13aa81b714cd3513b452afec88671ad5930535a158fa995c116e603b.dll
Size 500KB
Sample220121-3rhbfaddd9
SHA256 67a63fdf13aa81b714cd3513b452afec88671ad5930535a158fa995c116e603b
MD5 06c113520b7c6b424f9525a67769c4fb
SHA1 34d450fba9d83ee269fe1c3efe40e0fdd3e48375
SHA512 0e88ac42465687b94b4a8a7a85a53a6aec87d66b87dffecead26edbcab4693fa02c6361f96f6d60fb70f82bc7fbda6c7ba405a46fb984e0444a9db76fa1722b5
MD5 SHA1 SHA512

Score

10^/10

Family

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle

Squirrelwaffle Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3104-118-0x00000000036E0000-0x00000000036F1000-memory.dmp	squirrelwaffle
behavioral2/memory/3104-119-0x0000000003720000-0x0000000003730000-memory.dmp	squirrelwaffle

Program crash 1 IoCs

pid	pid_target	Process	procid_target
636	3104	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 3104	1908	rundll32.exe	69
PID 1908 wrote to memory of 3104	1908	rundll32.exe	69
PID 1908 wrote to memory of 3104	1908	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\67a63fdf13aa81b714cd3513b452afec88671ad5930535a158fa995c116e603b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\67a63fdf13aa81b714cd3513b452afec88671ad5930535a158fa995c116e603b.dll,#1
  2⤵
  PID:3104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 700
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:636

memory/3104-117-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Download

memory/3104-118-0x00000000036E0000-0x00000000036F1000-memory.dmp

Download

memory/3104-119-0x0000000003720000-0x0000000003730000-memory.dmp

Download