340b3710352f4446fdccbda281cdbe1c80ba7ce19d4c09db3137240feb9815e0

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wlycrqjl/lpk.dll
Size

45KB
MD5

6d69be00f87b765e1cf5c7303a2f4cd6
SHA1

dcfd01e48cb6fd4abfb2168c927751396645fc88
SHA256

3436427ba41d6b61d1cfc198f7bc1b2111ce6a69db83514acceb05c391c8c67c
SHA512

a6f377b6ce9649a3b846c01074307d6dec93882e98de65fa032f65e314cfd71bfffa88b7829c24559b55f6a2b9fcea24728db04314777b27988545fb3efd7867
SSDEEP

768:zojY9P368uUCS77GhGLhLpms1R6o9yHHojY9P:GmP6BS7LL18do9yHSm

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1920	hrl1047.tmp
1908	caycwq.exe

Loads dropped DLL 2 IoCs

pid	Process
780	rundll32.exe
780	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\caycwq.exe	hrl1047.tmp
File created	C:\Windows\SysWOW64\caycwq.exe	hrl1047.tmp

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 1968	1908	caycwq.exe	30

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 900 wrote to memory of 780	900	rundll32.exe	27
PID 780 wrote to memory of 1920	780	rundll32.exe	28
PID 780 wrote to memory of 1920	780	rundll32.exe	28
PID 780 wrote to memory of 1920	780	rundll32.exe	28
PID 780 wrote to memory of 1920	780	rundll32.exe	28
PID 1908 wrote to memory of 1968	1908	caycwq.exe	30
PID 1908 wrote to memory of 1968	1908	caycwq.exe	30
PID 1908 wrote to memory of 1968	1908	caycwq.exe	30
PID 1908 wrote to memory of 1968	1908	caycwq.exe	30
PID 1908 wrote to memory of 1968	1908	caycwq.exe	30
PID 1908 wrote to memory of 1968	1908	caycwq.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\wlycrqjl\lpk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\wlycrqjl\lpk.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Users\Admin\AppData\Local\Temp\hrl1047.tmp
    C:\Users\Admin\AppData\Local\Temp\hrl1047.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1920

C:\Windows\SysWOW64\caycwq.exe
C:\Windows\SysWOW64\caycwq.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hrl1047.tmp

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\hrl1047.tmp

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Windows\SysWOW64\caycwq.exe

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
C:\Windows\SysWOW64\caycwq.exe

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
\Users\Admin\AppData\Local\Temp\hrl1047.tmp

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
\Users\Admin\AppData\Local\Temp\hrl1047.tmp

Filesize
38KB

MD5
5660c4b61afede1f9781aea985bff3b0

SHA1
3e2b99888bc529c2cea5982075898f2592e0920a

SHA256
a3bda1ba9eeac56fd851bffcc7a998e8cef5d49c8a6ca77e97a987baae3ec89c

SHA512
5b47be8a7386ee413de061a117496e89e53d3e9dc4832293fc4bdb3294cf1f06e557f63c02935be9215c1d9c3ed04513aceb4339295819f7911d4822c2c7f8f3

Download Submit
memory/780-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1968-63-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1968-65-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download