Analysis
- max time kernel
107s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
10/10/2022, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
ovcfrnzu.dll
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ovcfrnzu.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target ovcfrnzu.dll
- Size 687KB
- Sample221010-e37hpsafa4
- SHA256 bf3c7f0ba324c96c9a9bff6cf21650a4b78edbc0076c68a9a125ebcba0e523c9
- MD5 37e6904d84153d1435407f4669135134
- SHA1 e4dd1f8fc4e44c8fd0e25242d994c4b59eed6939
- SHA512 4208f016541c9868354733342f0e2813d3d0fe47de7a4f40766946172039ab1addcc6601c3dedf363cbe4f785c07cbf67b67830a3f88b3a6f17309010a8cf379
- SSDEEP 12288:WJpOXg6QYZEEDBK51pF/0RP+xeQKg30xFAE4sLF8tW5XWQyYa7VROtv7:WSXgWYpFj+g39sLOtUyd7W1
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 5 IoCs
flow pid Process 13 4576 rundll32.exe 19 4576 rundll32.exe 20 4576 rundll32.exe 21 4576 rundll32.exe 23 4576 rundll32.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\NvTmRep_CrashReport2_{A2FE1952-0186-36D3-AAHC-B80CA35AH5B6}.job rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe 4576 rundll32.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4576 rundll32.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4576 rundll32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 944 wrote to memory of 4576 944 rundll32.exe 81 PID 944 wrote to memory of 4576 944 rundll32.exe 81 PID 944 wrote to memory of 4576 944 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ovcfrnzu.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ovcfrnzu.dll,#12⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4576
-