c2c54077a322b98e8ff65a82605390dabcc5916d709943ec833fdb7e25675ca2

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:12

Target

c2c54077a322b98e8ff65a82605390dabcc5916d709943ec833fdb7e25675ca2.dll
Size

83KB
MD5

072de9ed69e0be91675d716936c59d86
SHA1

a3c4d4d4485b459f266ff77ac0e1cafea2ea88b4
SHA256

c2c54077a322b98e8ff65a82605390dabcc5916d709943ec833fdb7e25675ca2
SHA512

530e48d5182e853cfdb55d4c1445e8035db8be7fdca24e420ffcf50af7d9f0226f32b06413d89d7adb8e4c066f8a212ad98cd7cbf7125cf7cdab8f5b64428736
SSDEEP

1536:KzWAnRBqDgdlWTmRIA9jqz+bksCWAHaIcQTT/y3eNyDyN1VyIo:AlwQgSSOqq7wSeo0q

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

4800 rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	rundll32.exe

pid	process
4800	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2308 wrote to memory of 4800	2308	rundll32.exe	rundll32.exe
PID 2308 wrote to memory of 4800	2308	rundll32.exe	rundll32.exe
PID 2308 wrote to memory of 4800	2308	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c2c54077a322b98e8ff65a82605390dabcc5916d709943ec833fdb7e25675ca2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4800-132-0x0000000000000000-mapping.dmp

Download
memory/4800-133-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4800-134-0x0000000000BE0000-0x0000000000BEF000-memory.dmp

Filesize
60KB

Download
memory/4800-135-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4800-136-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download