5fd161baf4a3621f9326f86e8373f8ba7e83d270b4a26f0cdcc83639d2528da9

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 19:07

Target

5fd161baf4a3621f9326f86e8373f8ba7e83d270b4a26f0cdcc83639d2528da9.dll
Size

138KB
MD5

063010515f84e681cf5fec062ace4fc4
SHA1

2f0f7f659fe8dde3e1848d7f4b1d9052450488d3
SHA256

5fd161baf4a3621f9326f86e8373f8ba7e83d270b4a26f0cdcc83639d2528da9
SHA512

e20c85f475ee7935f41ea72231f174d44ef07ebba37bdeef3acb0da7fd81fdd01ee98ef0b05644b77ca424056dae8506abd0ae13cde2171ed1e9d3877fdb5f06
SSDEEP

3072:SkZcVsZnLESH8kk6qRcs9WOfcEOEOuRwgCytY8Xb8Y+o/:1ZcMnYSHc9WOfBrpMYn

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 976	1916	rundll32.exe	27
PID 1916 wrote to memory of 976	1916	rundll32.exe	27
PID 1916 wrote to memory of 976	1916	rundll32.exe	27
PID 1916 wrote to memory of 976	1916	rundll32.exe	27
PID 1916 wrote to memory of 976	1916	rundll32.exe	27
PID 1916 wrote to memory of 976	1916	rundll32.exe	27
PID 1916 wrote to memory of 976	1916	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fd161baf4a3621f9326f86e8373f8ba7e83d270b4a26f0cdcc83639d2528da9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fd161baf4a3621f9326f86e8373f8ba7e83d270b4a26f0cdcc83639d2528da9.dll,#1
  2⤵
  PID:976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/976-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/976-56-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download