Analysis

  • max time kernel
    92s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2022 15:53

General

  • Target

    017d9b069d8fad1a5a2826173ea64b1b78536b3e56ab2df4c86a1c07f2f2b5ad.dll

  • Size

    90KB

  • MD5

    8413c80909a6f22d72e6a370f18bf46e

  • SHA1

    97424461f6666d83366b53a1dfb455f4d623a793

  • SHA256

    017d9b069d8fad1a5a2826173ea64b1b78536b3e56ab2df4c86a1c07f2f2b5ad

  • SHA512

    dc20db4d86f10a88f1b55b7260c542506208d5bf2098269bcd504dd144237d1889a45ccd624f38d9353944a752cd006f0cd2e2d0c5256ecb20d5446cac0235bd

  • SSDEEP

    1536:jM3AWafa1LDlnDDHFm0P5feNHNM27A9ErWn889rnPnnbmfsWBy0TgU:j3fa1NDDHcseNHNESwnPnYBy08U

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\017d9b069d8fad1a5a2826173ea64b1b78536b3e56ab2df4c86a1c07f2f2b5ad.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:932
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\017d9b069d8fad1a5a2826173ea64b1b78536b3e56ab2df4c86a1c07f2f2b5ad.dll,#1
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3984
      • \??\c:\windows\SysWOW64\svchost.exe
        c:\windows\SysWOW64\svchost.exe
        3⤵
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:4972

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3984-132-0x0000000000000000-mapping.dmp

  • memory/4972-133-0x0000000000000000-mapping.dmp

  • memory/4972-134-0x0000000010000000-0x0000000010026000-memory.dmp

    Filesize

    152KB

  • memory/4972-137-0x0000000001750000-0x000000000179E000-memory.dmp

    Filesize

    312KB