a42a94dbb4ed29fd71b0d4e67082bb01cf678d08582f46fe16f1c88b9e58f946

Analysis

max time kernel
55s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:07

Target

a42a94dbb4ed29fd71b0d4e67082bb01cf678d08582f46fe16f1c88b9e58f946.dll
Size

41KB
MD5

eedbb80f1f86de86a725e732e59b57bc
SHA1

0db7783259907768cf8f300a2953707d926afa16
SHA256

a42a94dbb4ed29fd71b0d4e67082bb01cf678d08582f46fe16f1c88b9e58f946
SHA512

c82e86a9fccfba73c051eb462080a950f047b706f904f3a2fc75bbbce1d1892c1c6f22521fe0f661b8a39c4cab368cda6a46a3f431bde4528281cabc2420977c
SSDEEP

768:WCpqOQdwHPoBuUSdB6zW/U9Bok+VN5KvwEW3XkjTkd4Btd8VeGiSB8xZ:RpqOQYM9SzsoBBta78E9SmxZ

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 276 wrote to memory of 948	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 948	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 948	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 948	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 948	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 948	276	rundll32.exe	rundll32.exe
PID 276 wrote to memory of 948	276	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a42a94dbb4ed29fd71b0d4e67082bb01cf678d08582f46fe16f1c88b9e58f946.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a42a94dbb4ed29fd71b0d4e67082bb01cf678d08582f46fe16f1c88b9e58f946.dll,#1
2⤵
- Writes to the Master Boot Record (MBR)
PID:948

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/948-54-0x0000000000000000-mapping.dmp

Download
memory/948-55-0x0000000074D71000-0x0000000074D73000-memory.dmp

Filesize
8KB

Download