44cf993bea888af81a2d6d85b1b70c2b5a18f96d8db7b6f3c03cfbabec60ec69

Analysis

max time kernel
70s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20220718-en
resource tags

arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 01:02

Target
9aaac18b32c87873e975c1ddc9ddb8b1.dll
Size 5.0MB
Sample220720-bdsrgaadhj
SHA256 44cf993bea888af81a2d6d85b1b70c2b5a18f96d8db7b6f3c03cfbabec60ec69
MD5 9aaac18b32c87873e975c1ddc9ddb8b1
SHA1 ec60c147985c0cd1204c3bcf936a66405ce57b80
SHA512 dc098d9cc0451a318d8112db2eb8db533a59dbf5afc23f1ba159aea47174da698223ee5b481f6c69cb5aba2bad00c67f86e118d6caa79910fce9f94a2295e636
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4960	mssecsvc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 4804	984	rundll32.exe	76
PID 984 wrote to memory of 4804	984	rundll32.exe	76
PID 984 wrote to memory of 4804	984	rundll32.exe	76
PID 4804 wrote to memory of 4960	4804	rundll32.exe	77
PID 4804 wrote to memory of 4960	4804	rundll32.exe	77
PID 4804 wrote to memory of 4960	4804	rundll32.exe	77

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9aaac18b32c87873e975c1ddc9ddb8b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9aaac18b32c87873e975c1ddc9ddb8b1.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    PID:4960

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 290d8a8053ec0ba382f4d0b579ab4668366685af11e9fc65e91855aa61120706
MD5 66bce53851b845d505d834ce59381ccd
SHA1 ce3413618165f19431c724622ae35dbd4de371b0
SHA512 1013608743d4ba3efb0037a04d29e75f9c748bc221261d1d972e5be48e64a0c8655c8dd84b14ac2a61e5bec6f43bcc6f5b37fb2761475054d43a469e80d1b256
SSDEEP 49152:wnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAkXw:wDqPoBhz1aRxcSUDk36SAh
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 290d8a8053ec0ba382f4d0b579ab4668366685af11e9fc65e91855aa61120706
MD5 66bce53851b845d505d834ce59381ccd
SHA1 ce3413618165f19431c724622ae35dbd4de371b0
SHA512 1013608743d4ba3efb0037a04d29e75f9c748bc221261d1d972e5be48e64a0c8655c8dd84b14ac2a61e5bec6f43bcc6f5b37fb2761475054d43a469e80d1b256
SSDEEP 49152:wnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAkXw:wDqPoBhz1aRxcSUDk36SAh
MD5 SHA1 SHA512 SSDEEP

Submit Download