c81754d212621c884718aba02476af4175412e30823cda1a41ab0a0c0bf9c19c

Analysis

max time kernel
142s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c81754d212621c884718aba02476af4175412e30823cda1a41ab0a0c0bf9c19c.dll
Size

152KB
MD5

0fbd16d155faf10f38c74d7e931dc2f0
SHA1

63ac678c605af17d678d8278518006cf0267b310
SHA256

c81754d212621c884718aba02476af4175412e30823cda1a41ab0a0c0bf9c19c
SHA512

a07dcbaa27fc7cb53c0997b8913551b104640794c8184f5e8cc5c5483fa4e882f2e47ee4bb0915cc3b4f903bbcedc95bdc384d9e45f3a3d24b7ac907c3731d37
SSDEEP

3072:GRBon18WyHSwt2DrLDeMtFN2UAdlwaN1uL5QAXUxOz:GRBE8WyHSgMrJF2UAbwaNnAXUxi

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4904	hrlC8D3.tmp
5044	kcimci.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kcimci.exe	hrlC8D3.tmp
File opened for modification	C:\Windows\SysWOW64\kcimci.exe	hrlC8D3.tmp

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5044 set thread context of 2576	5044	kcimci.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5008	2576	WerFault.exe	83

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 4944	3436	rundll32.exe	80
PID 3436 wrote to memory of 4944	3436	rundll32.exe	80
PID 3436 wrote to memory of 4944	3436	rundll32.exe	80
PID 4944 wrote to memory of 4904	4944	rundll32.exe	81
PID 4944 wrote to memory of 4904	4944	rundll32.exe	81
PID 4944 wrote to memory of 4904	4944	rundll32.exe	81
PID 5044 wrote to memory of 2576	5044	kcimci.exe	83
PID 5044 wrote to memory of 2576	5044	kcimci.exe	83
PID 5044 wrote to memory of 2576	5044	kcimci.exe	83
PID 5044 wrote to memory of 2576	5044	kcimci.exe	83
PID 5044 wrote to memory of 2576	5044	kcimci.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c81754d212621c884718aba02476af4175412e30823cda1a41ab0a0c0bf9c19c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c81754d212621c884718aba02476af4175412e30823cda1a41ab0a0c0bf9c19c.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Users\Admin\AppData\Local\Temp\hrlC8D3.tmp
    C:\Users\Admin\AppData\Local\Temp\hrlC8D3.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4904

C:\Windows\SysWOW64\kcimci.exe
C:\Windows\SysWOW64\kcimci.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 12
    3⤵
    - Program crash
    PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2576 -ip 2576
1⤵
PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hrlC8D3.tmp

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hrlC8D3.tmp

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Windows\SysWOW64\kcimci.exe

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Windows\SysWOW64\kcimci.exe

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
memory/2576-139-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download