21a77e00627ddd6541f559651be67482ce29b079969379038b5ea5424c275cab | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-06-2022 07:53

Sharing

Report Analysis Logs

General

Target

21a77e00627ddd6541f559651be67482ce29b079969379038b5ea5424c275cab.dll
Size

141KB
MD5

38bd1d49f88201a9a6a92ae3f65559c0
SHA1

010847f30975fbac9a45ffc6e70ed640614e4852
SHA256

21a77e00627ddd6541f559651be67482ce29b079969379038b5ea5424c275cab
SHA512

4ff916f7ea78fbd0c0fbb663dc53d8a6060fae819a7f0da09d114d832dde1634943cb603787954fdb0a5fbae20bcc0a2d29157f7b7a1139c8f41424a655db858

Score

10^/10

suricata

Malware Config

Signatures

suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata: ET MALWARE Locky CnC Checkin HTTP Pattern
suricata
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata: ET MALWARE Locky CnC checkin Nov 21
suricata
Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exe

flow pid process

1 1916 rundll32.exe
2 1916 rundll32.exe
15 1916 rundll32.exe
20 1916 rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1180 wrote to memory of 1916	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 1916	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 1916	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 1916	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 1916	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 1916	1180	rundll32.exe	rundll32.exe
PID 1180 wrote to memory of 1916	1180	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21a77e00627ddd6541f559651be67482ce29b079969379038b5ea5424c275cab.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\21a77e00627ddd6541f559651be67482ce29b079969379038b5ea5424c275cab.dll,#1
2⤵
- Blocklisted process makes network request
PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1916-54-0x0000000000000000-mapping.dmp

Download
memory/1916-55-0x0000000076C81000-0x0000000076C83000-memory.dmp

Filesize
8KB

Download