Analysis

  • max time kernel
    4294212s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    06-03-2022 17:05

General

  • Target

    a3c14b0b4756017ee248d0fa029196060ca1f75a1fab7e9d81c74fbaac6a4797.dll

  • Size

    119KB

  • MD5

    959ff528ddbee66e49992cd654d41bab

  • SHA1

    7b54da1fb2cbe877b13de309c01a7112224e1f40

  • SHA256

    a3c14b0b4756017ee248d0fa029196060ca1f75a1fab7e9d81c74fbaac6a4797

  • SHA512

    ef0852311f23f255624c31f320847b5d6ea2da86d81e0693207444b39b73a0f58a0e3f847c585e1a734dc902b1a429c53e193f742e81a60399ac061e76623b54

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3c14b0b4756017ee248d0fa029196060ca1f75a1fab7e9d81c74fbaac6a4797.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3c14b0b4756017ee248d0fa029196060ca1f75a1fab7e9d81c74fbaac6a4797.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1576-54-0x0000000076891000-0x0000000076893000-memory.dmp
    Filesize

    8KB