ce042a07d6f3907e468295e401968435e8d2315f3c913f215e4994e64cc0844f

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 12:14

Target

ce042a07d6f3907e468295e401968435e8d2315f3c913f215e4994e64cc0844f.dll
Size

63KB
MD5

67f60fe2486fc92633e598a9af1a9b55
SHA1

c6fafdad7f47017440cd473d2c3edcbb29adcc3b
SHA256

ce042a07d6f3907e468295e401968435e8d2315f3c913f215e4994e64cc0844f
SHA512

792362a65388c568214ef9a02f54c25fc4f26869882bb6b1b1e995a36cd9399493dfaada8575c12897d613749bf2cb7ab2c175709681c6d71405aea672b414ad
SSDEEP

1536:aqcSpyjkghgeQc4dq6H3pZw59kpNRSm1OAyFGwLQBamGe:aqzXiQldqa3TqKXOAyFswm/

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1108	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 1108	360	rundll32.exe	27
PID 360 wrote to memory of 1108	360	rundll32.exe	27
PID 360 wrote to memory of 1108	360	rundll32.exe	27
PID 360 wrote to memory of 1108	360	rundll32.exe	27
PID 360 wrote to memory of 1108	360	rundll32.exe	27
PID 360 wrote to memory of 1108	360	rundll32.exe	27
PID 360 wrote to memory of 1108	360	rundll32.exe	27
PID 1108 wrote to memory of 1268	1108	rundll32.exe	14

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1108-55-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1108-56-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download