bf3c7f0ba324c96c9a9bff6cf21650a4b78edbc0076c68a9a125ebcba0e523c9

Resubmissions

21/02/2023, 14:12

10/10/2022, 04:28

max time kernel
75s
max time network
80s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 04:28

Target
ovcfrnzu.dll
Size 687KB
Sample221010-e37hpsafa4
SHA256 bf3c7f0ba324c96c9a9bff6cf21650a4b78edbc0076c68a9a125ebcba0e523c9
MD5 37e6904d84153d1435407f4669135134
SHA1 e4dd1f8fc4e44c8fd0e25242d994c4b59eed6939
SHA512 4208f016541c9868354733342f0e2813d3d0fe47de7a4f40766946172039ab1addcc6601c3dedf363cbe4f785c07cbf67b67830a3f88b3a6f17309010a8cf379
SSDEEP 12288:WJpOXg6QYZEEDBK51pF/0RP+xeQKg30xFAE4sLF8tW5XWQyYa7VROtv7:WSXgWYpFj+g39sLOtUyd7W1
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Blocklisted process makes network request 5 IoCs

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\NvTmRep_CrashReport2_{A2FE1952-0186-36D3-AAHC-B80CA35AH5B6}.job	rundll32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	rundll32.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1204	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovcfrnzu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ovcfrnzu.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1204

memory/1204-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Download

memory/1204-56-0x0000000000180000-0x00000000001DD000-memory.dmp

Download