ebf3e7290b8fd1e5509caa69335251f22b61baf3f9ff87b4e8544f3c1fea279d | Triage

Analysis

max time kernel
101s
max time network
95s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
04-08-2022 18:19

Sharing

Report Analysis Logs

General

Target

pinrules.stl
Size

17KB
MD5

ffa4c0dd7b7601ee3ac59cee61e0803e
SHA1

167e53131eee30c41b28d466a7af835368289867
SHA256

48ac1b4059632ff4e41215da733af9d8e4e506fabad0f13e9b03362687cad9e5
SHA512

332fe8cc86e950d87a25b2af947836ba0eb9ebe46c1907b492f9e0037034e7d60af1e27484d96d32ac575ab52b4e28532b3c13467d29b291f1f51bb706567cc3

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

2 892 rundll32.exe
4 892 rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

892 rundll32.exe

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe cryptext.dll,CryptExtOpenCTL C:\Users\Admin\AppData\Local\Temp\pinrules.stl
1⤵
- Blocklisted process makes network request
- Suspicious behavior: GetForegroundWindowSpam
PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/892-54-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download