d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
228s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

browseti.dll
Size

170KB
MD5

d6cef69f5d36e11b80d471325e459d9e
SHA1

83e4894b90afac4e22abd0c6ebbcba76d44f3a7f
SHA256

55a168464d6df1a62a8cf437f303350990e00031db4ea34a98402045c843e437
SHA512

2550bfc95b88e630edf01f94db8c06638f27238a78a5ed06378a922130ac214d861828d967991633cb1fa9b884535cf99f2dff05ac4c9d8aa66f56093bbc974f
SSDEEP

3072:d3jcSdKopgjQjI423eVDjXG3JvPk7n9LrlZ4xl2EZacUs:d3QSdKo2jOIf3epjX8k7nsZ/

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\browseti.log rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1364 wrote to memory of 556	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 556	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 556	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 556	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 556	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 556	1364	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 556	1364	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\browseti.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\browseti.dll,#1
2⤵
- Drops file in System32 directory
PID:556

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-54-0x0000000000000000-mapping.dmp

Download
memory/556-55-0x0000000076771000-0x0000000076773000-memory.dmp

Filesize
8KB

Download