Analysis

  • max time kernel
    112s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 14:24

General

  • Target

    08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll

  • Size

    145KB

  • MD5

    085d007b613aa0448218713e2e5b21c8

  • SHA1

    20da36e46973bbb516ebd065fc07b5090041a218

  • SHA256

    08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4

  • SHA512

    13867eecd52f178a4f9ad35c77211b8b3447d1c035ec30a55d201e10f0e85a7ffd266034aba6ae2d719bbf0ec93d4b5c72543e9c07e814c4f06b1a657ff5f85e

  • SSDEEP

    3072:eIm/CwXIp6oU7TGxWEhieYhi5U+cHeDegw23w5q0RT9:S/LIp6oU7czhiPhiu+yUk238qY

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3548
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\08c92bf3d20f09e461e12e040e873e6dd3fc892a913eb5e5f3f13ac2fcb495c4.dll,#1
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4904
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        3⤵
        • Modifies registry class
        PID:4892

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4904-133-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/4904-134-0x0000000010001000-0x0000000010039000-memory.dmp

    Filesize

    224KB

  • memory/4904-135-0x0000000010000000-0x0000000010048000-memory.dmp

    Filesize

    288KB

  • memory/4904-138-0x00000000025E0000-0x00000000026E0000-memory.dmp

    Filesize

    1024KB