squirrelwaffle | 47e32a4b5c12ea44dd41bcadad64ea9dca197f055e0cb345be6c207c3cc7e214

Analysis

Target
47e32a4b5c12ea44dd41bcadad64ea9dca197f055e0cb345be6c207c3cc7e214.dll
Size 324KB
Sample220130-sh684adeg3
SHA256 47e32a4b5c12ea44dd41bcadad64ea9dca197f055e0cb345be6c207c3cc7e214
MD5 9134bb1a46279ef8860b4b3f3f5ebea1
SHA1 ead73410d9d8137b9b2ff852bf1ac9228b79a690
SHA512 1197b0f2a80f61914440659dcf6b84097a457818a5a35357ae64c73e650fac248d19a3a7c82bbc10f4fc6bb184d9ef193bdf6105212807c12131c7fa8453c281
MD5 SHA1 SHA512

Score

10^/10

Family

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle

Squirrelwaffle Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3240-116-0x0000000010000000-0x000000001004D000-memory.dmp	squirrelwaffle

Blocklisted process makes network request 5 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 3240	2732	rundll32.exe	69
PID 2732 wrote to memory of 3240	2732	rundll32.exe	69
PID 2732 wrote to memory of 3240	2732	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\47e32a4b5c12ea44dd41bcadad64ea9dca197f055e0cb345be6c207c3cc7e214.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\47e32a4b5c12ea44dd41bcadad64ea9dca197f055e0cb345be6c207c3cc7e214.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:3240

memory/3240-115-0x0000000002C40000-0x0000000002C63000-memory.dmp

Download

memory/3240-116-0x0000000010000000-0x000000001004D000-memory.dmp

Download