f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd

Analysis

max time kernel
185s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 09:14

Target

f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll
Size

738KB
MD5

0bfb96723fd4b34049b50d646fa03197
SHA1

ea6a64b044487026c3369f3ba522dd670e6d5ee2
SHA256

f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd
SHA512

30cb58ae6b85e39ac15d0508e6e64332bc606f73e32c9bb3de0d19e6a9f853357160249363b73a457f9dc59b5f074ed878d963f19f5415794c677095baa4a948
SSDEEP

12288:MwGsNHl+QXfQrKFAVUBhrTVNXO7H7N7u18rdHQ8aq+DFER:+sNHlNfQrKFEUn9N+bZu18rdHQ8a7DFM

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

37 2616 rundll32.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe

flow	pid	process
37	2616	rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Modifies registry class 3 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ÀĈÀĈ	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ÀĈÀĈ\ = "{DB417A4F-56BD-2362-181B-580006CE1615}"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\ÀĈÀĈ\䅺뷛扖 = "15"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2616 rundll32.exe
2616 rundll32.exe

pid	process
2616	rundll32.exe
2616	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 224 wrote to memory of 2616	224	rundll32.exe	rundll32.exe
PID 224 wrote to memory of 2616	224	rundll32.exe	rundll32.exe
PID 224 wrote to memory of 2616	224	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f234099dc0a75ab83721fd2f177c93a9934ccbe0eefefa27400899c1287c38bd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:224

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/2616-132-0x0000000000000000-mapping.dmp

Download
memory/2616-133-0x0000000010000000-0x00000000102AE000-memory.dmp

Filesize
2.7MB

Download