d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb | Triage

Analysis

max time kernel
23s
max time network
46s
platform
windows7_x64
resource
win7-20220331-en
submitted
09-04-2022 01:08

Sharing

Report Analysis Logs

General

Target

x.cer
Size

1KB
MD5

55540a230bdab55187a841cfe1aa1545
SHA1

363e4734f757bdeb89868efe94907774a327695e
SHA256

d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512

c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 960 rundll32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

rundll32.exe

pid process

960 rundll32.exe

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe cryptext.dll,CryptExtOpenCER C:\Users\Admin\AppData\Local\Temp\x.cer
1⤵
- Blocklisted process makes network request
- Suspicious use of FindShellTrayWindow
PID:960

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-54-0x000007FEFBAE1000-0x000007FEFBAE3000-memory.dmp

Filesize
8KB

Download