Overview
overview
8Static
static
printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
8printerfix...pl.dll
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...sv.exe
windows7-x64
printerfix...sv.exe
windows10-2004-x64
1printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2022 08:10
Static task
static1
Behavioral task
behavioral1
Sample
printerfix/LTSC/Fix_PrintSpooler.bat
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
printerfix/LTSC/Fix_PrintSpooler.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
printerfix/LTSC/win32spl.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
printerfix/LTSC/win32spl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
printerfix/Win 2012/Fix_PrintSpooler.bat
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
printerfix/Win 2012/Fix_PrintSpooler.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
printerfix/Win 2012/win32spl.dll
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
printerfix/Win 2012/win32spl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
printerfix/Win 2016/Fix_PrintSpooler.bat
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
printerfix/Win 2016/Fix_PrintSpooler.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
printerfix/Win 2016/win32spl.dll
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
printerfix/Win 2016/win32spl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
printerfix/Win 2019/Fix_PrintSpooler.bat
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
printerfix/Win 2019/Fix_PrintSpooler.bat
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
printerfix/Win 2019/win32spl.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
printerfix/Win 2019/win32spl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
printerfix/win7/Fix_PrintSpooler.bat
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
printerfix/win7/Fix_PrintSpooler.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
printerfix/win7/win32spl.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
printerfix/win7/win32spl.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
printerfix/旧文件归档/localspl.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
printerfix/旧文件归档/localspl.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
printerfix/旧文件归档/spoolsv.exe
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
printerfix/旧文件归档/spoolsv.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
printerfix/旧文件归档/win32spl.dll
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
printerfix/旧文件归档/win32spl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
printerfix/适合win10-20H版本后/Fix_PrintSpooler.bat
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
printerfix/适合win10-20H版本后/Fix_PrintSpooler.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
printerfix/适合win10-20H版本后/win32spl.dll
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
printerfix/适合win10-20H版本后/win32spl.dll
Resource
win10v2004-20220812-en
General
-
Target
printerfix/旧文件归档/win32spl.dll
-
Size
613KB
-
MD5
829f9e0d63e9a4e8c1a40a821114e189
-
SHA1
356f13b8db6918d4fbc4c59b50c970d3b175bedc
-
SHA256
b027966e23657a6007806a69624a211d3e7ae0cbf1a80ce057fd5072aa2bf1a7
-
SHA512
e40b8b59fa129c455e2530ff15a63127da09adf897b82775badc27036fbfdf36a8c93822b0023f788f8a16ddc3dd983a718c24acda355a51b7162bee01c4cb27
-
SSDEEP
12288:NcDnAlo784gqSp1k/Lfr8aJ3sWuib49isyUnVhZzj0leLkh1z24pN:NcDnAlo7LRCk/LfjsWuibiisyUnJzj0t
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 2000 wrote to memory of 3708 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 3708 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 3708 2000 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\printerfix\旧文件归档\win32spl.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\printerfix\旧文件归档\win32spl.dll,#12⤵PID:3708
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3708-132-0x0000000000000000-mapping.dmp