d1505a8ac2409207637b344848d53a2e189a04873ebc87ac3155f7cd05b0e348 | Triage

Analysis

max time kernel
158s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 20:52

Sharing

Report Analysis Logs

General

Target

browseti.dll
Size

170KB
MD5

d6cef69f5d36e11b80d471325e459d9e
SHA1

83e4894b90afac4e22abd0c6ebbcba76d44f3a7f
SHA256

55a168464d6df1a62a8cf437f303350990e00031db4ea34a98402045c843e437
SHA512

2550bfc95b88e630edf01f94db8c06638f27238a78a5ed06378a922130ac214d861828d967991633cb1fa9b884535cf99f2dff05ac4c9d8aa66f56093bbc974f
SSDEEP

3072:d3jcSdKopgjQjI423eVDjXG3JvPk7n9LrlZ4xl2EZacUs:d3QSdKo2jOIf3epjX8k7nsZ/

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\browseti.log rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2032 wrote to memory of 4432	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 4432	2032	rundll32.exe	rundll32.exe
PID 2032 wrote to memory of 4432	2032	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\browseti.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\browseti.dll,#1
2⤵
- Drops file in System32 directory
PID:4432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4432-132-0x0000000000000000-mapping.dmp

Download