114af1dd41d864d3fc5305adf3847d3183cd70a24b8292bda8ee06b2c6e07428

Analysis

max time kernel
202s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:54

Target

mirserver/Mir200/000gm.dll
Size

784KB
MD5

79a3122df2091b4efa2b73aa390ccd77
SHA1

5b0ea140c59a8b32e31b99f855a4d7844470817b
SHA256

81e4085d381bc9343420993261c54e7fb7c18e1d564a0233835bcd84e8aa8161
SHA512

c3ebab2bda7fe0752aa1368ca17ea71849f04e7db0bf10081ec09b2a14c698ac43ebcaf685efeb70af83c6492274746d72724ce7ef71a754ab9c9e2c54caa6ad
SSDEEP

6144:JbtnBgJj1/jpXGo5Pm2VRCg+odmWRkctr/lLKnNMxRAzDfgHFhYdC+52KwnOE9iM:JxBgJVTfcg+odJyMg6DA/fNdCMwOhM

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Config.ini rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Config.ini	rundll32.exe

Suspicious use of SetWindowsHookEx 30 IoCs

Processes:

rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 4872 wrote to memory of 5004	4872	rundll32.exe	rundll32.exe
PID 4872 wrote to memory of 5004	4872	rundll32.exe	rundll32.exe
PID 4872 wrote to memory of 5004	4872	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\mirserver\Mir200\000gm.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4872