55347ce96540efe756d9ebe83845813e6e6df558f78df5ece6dcbaddb8f6268c

Analysis

max time kernel
91s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2022, 05:00

Target
8104494f64b0e63a13597458948d8b42.dll
Size 5.0MB
Sample220720-fm1kwscehk
SHA256 55347ce96540efe756d9ebe83845813e6e6df558f78df5ece6dcbaddb8f6268c
MD5 8104494f64b0e63a13597458948d8b42
SHA1 6843c6523b22cf65175ce4e2f90d6a7d9bd6aae3
SHA512 29438780398cee3f2573364ff2d94099f64a5974e9e1b6d8c7fb828eeef2d9b930c4892c2973cfd907f546c83d82c31a01e550c29383277698a37dda420b5250
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
4464	mssecsvc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 548	3260	rundll32.exe	80
PID 3260 wrote to memory of 548	3260	rundll32.exe	80
PID 3260 wrote to memory of 548	3260	rundll32.exe	80
PID 548 wrote to memory of 4464	548	rundll32.exe	81
PID 548 wrote to memory of 4464	548	rundll32.exe	81
PID 548 wrote to memory of 4464	548	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8104494f64b0e63a13597458948d8b42.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8104494f64b0e63a13597458948d8b42.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe
    3⤵
    - Executes dropped EXE
    PID:4464

mssecsvc.exe

Path C:\WINDOWS\mssecsvc.exe
Size 3.6MB
SHA256 181f1772fbf4ef9efec7cc4766542203efc2be94289fe423e45ae5d03bb33f6d
MD5 f51b48ba3b2bf4235140372843a2864f
SHA1 f0211a7b3c47075e2f8638036b5265ac77d16077
SHA512 5ef36c0455005eab17e3cf712ac7d9c72b1a5abcbca775215e48c86fa6a5507b1cf74f1c7ae8e48696cf3e59740e941f6cc447e741bd0f9f1a882f2cad57cba1
SSDEEP 12288:GVbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFr:wbLgddQhfdmMSirYbcMNgef0QeQjGu
MD5 SHA1 SHA512 SSDEEP

Submit Download

mssecsvc.exe

Path C:\Windows\mssecsvc.exe
Size 3.6MB
SHA256 181f1772fbf4ef9efec7cc4766542203efc2be94289fe423e45ae5d03bb33f6d
MD5 f51b48ba3b2bf4235140372843a2864f
SHA1 f0211a7b3c47075e2f8638036b5265ac77d16077
SHA512 5ef36c0455005eab17e3cf712ac7d9c72b1a5abcbca775215e48c86fa6a5507b1cf74f1c7ae8e48696cf3e59740e941f6cc447e741bd0f9f1a882f2cad57cba1
SSDEEP 12288:GVbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjEXFr:wbLgddQhfdmMSirYbcMNgef0QeQjGu
MD5 SHA1 SHA512 SSDEEP

Submit Download