af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80

General

Target

af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe
Size

161KB
MD5

5dab4c93d70b6ae866f0316314155b36
SHA1

4a133dd40cb6c10f6e71ef9b607a02cf2d9387bc
SHA256

af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80
SHA512

7fc73b4564969c2002477fe90f18500ba9dd6b0cefcc71859d4a3585fd1c1e109268fd7d3f6232e204dc9766be91b14cf003b561f60d6860416043f3b5e43475
SSDEEP

3072:/4TOiTcfM1Nr+Zj9kAvunduSSp3ZXvRtjXdIQ273bpYAWUQxBO6HCq0OdZZ:7j01Nrckjngp/RtruMUQxgq0O

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
3064	rundll32.exe
2456	rundll32.exe
3156	rundll32.exe
4252	rundll32.exe
3412	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4252	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	83
PID 4056 wrote to memory of 4252	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	83
PID 4056 wrote to memory of 4252	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	83
PID 4056 wrote to memory of 3064	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	84
PID 4056 wrote to memory of 3064	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	84
PID 4056 wrote to memory of 3064	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	84
PID 4056 wrote to memory of 3412	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	85
PID 4056 wrote to memory of 3412	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	85
PID 4056 wrote to memory of 3412	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	85
PID 4056 wrote to memory of 3156	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	86
PID 4056 wrote to memory of 3156	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	86
PID 4056 wrote to memory of 3156	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	86
PID 4056 wrote to memory of 2456	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	87
PID 4056 wrote to memory of 2456	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	87
PID 4056 wrote to memory of 2456	4056	af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe	87

C:\Users\Admin\AppData\Local\Temp\af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe
"C:\Users\Admin\AppData\Local\Temp\af52d238c4333c360effdaa26656644f61f5ed61492b48d184a60cd16016db80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\pinet.dll",PszMonthFromIndex
  2⤵
  - Loads dropped DLL
  PID:4252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\pinet.dll",PszMonthFromIndex
  2⤵
  - Loads dropped DLL
  PID:3064
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\pinet.dll",PszMonthFromIndex
  2⤵
  - Loads dropped DLL
  PID:3412
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\pinet.dll",PszMonthFromIndex
  2⤵
  - Loads dropped DLL
  PID:3156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\pinet.dll",PszMonthFromIndex
  2⤵
  - Loads dropped DLL
  PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\pinet.dll

Filesize
161KB

MD5
c3b5d7b3ce9a5432c55cedd867908f91

SHA1
65e68f137f4472ae13a925548e84f448dc005b90

SHA256
c5aaac8a4d15814ce193d4bce4baec929573e537a3758ad06605691515627c52

SHA512
205657dee0e53035c1cb9c7c40da11b59b7537d97510096e62e68f8abfdfdefe2d42a72179b9e55b08594fac3bbccd9fe6f109dba18941f044f139c085801bf0

Download Submit
C:\Users\Admin\AppData\Roaming\pinet.dll

Filesize
161KB

MD5
c3b5d7b3ce9a5432c55cedd867908f91

SHA1
65e68f137f4472ae13a925548e84f448dc005b90

SHA256
c5aaac8a4d15814ce193d4bce4baec929573e537a3758ad06605691515627c52

SHA512
205657dee0e53035c1cb9c7c40da11b59b7537d97510096e62e68f8abfdfdefe2d42a72179b9e55b08594fac3bbccd9fe6f109dba18941f044f139c085801bf0

Download Submit
C:\Users\Admin\AppData\Roaming\pinet.dll

Filesize
161KB

MD5
c3b5d7b3ce9a5432c55cedd867908f91

SHA1
65e68f137f4472ae13a925548e84f448dc005b90

SHA256
c5aaac8a4d15814ce193d4bce4baec929573e537a3758ad06605691515627c52

SHA512
205657dee0e53035c1cb9c7c40da11b59b7537d97510096e62e68f8abfdfdefe2d42a72179b9e55b08594fac3bbccd9fe6f109dba18941f044f139c085801bf0

Download Submit
C:\Users\Admin\AppData\Roaming\pinet.dll

Filesize
161KB

MD5
c3b5d7b3ce9a5432c55cedd867908f91

SHA1
65e68f137f4472ae13a925548e84f448dc005b90

SHA256
c5aaac8a4d15814ce193d4bce4baec929573e537a3758ad06605691515627c52

SHA512
205657dee0e53035c1cb9c7c40da11b59b7537d97510096e62e68f8abfdfdefe2d42a72179b9e55b08594fac3bbccd9fe6f109dba18941f044f139c085801bf0

Download Submit
C:\Users\Admin\AppData\Roaming\pinet.dll

Filesize
161KB

MD5
c3b5d7b3ce9a5432c55cedd867908f91

SHA1
65e68f137f4472ae13a925548e84f448dc005b90

SHA256
c5aaac8a4d15814ce193d4bce4baec929573e537a3758ad06605691515627c52

SHA512
205657dee0e53035c1cb9c7c40da11b59b7537d97510096e62e68f8abfdfdefe2d42a72179b9e55b08594fac3bbccd9fe6f109dba18941f044f139c085801bf0

Download Submit
C:\Users\Admin\AppData\Roaming\pinet.dll

Filesize
161KB

MD5
c3b5d7b3ce9a5432c55cedd867908f91

SHA1
65e68f137f4472ae13a925548e84f448dc005b90

SHA256
c5aaac8a4d15814ce193d4bce4baec929573e537a3758ad06605691515627c52

SHA512
205657dee0e53035c1cb9c7c40da11b59b7537d97510096e62e68f8abfdfdefe2d42a72179b9e55b08594fac3bbccd9fe6f109dba18941f044f139c085801bf0

Download Submit
memory/2456-142-0x0000000000000000-mapping.dmp

Download
memory/2456-175-0x0000000000520000-0x0000000000534000-memory.dmp

Filesize
80KB

Download
memory/2456-154-0x00000000009F0000-0x0000000000A1B000-memory.dmp

Filesize
172KB

Download
memory/3064-155-0x0000000002030000-0x000000000205B000-memory.dmp

Filesize
172KB

Download
memory/3064-139-0x0000000000000000-mapping.dmp

Download
memory/3064-172-0x0000000002010000-0x0000000002024000-memory.dmp

Filesize
80KB

Download
memory/3156-157-0x00000000005B0000-0x00000000005DB000-memory.dmp

Filesize
172KB

Download
memory/3156-141-0x0000000000000000-mapping.dmp

Download
memory/3412-158-0x0000000002DD0000-0x0000000002DFB000-memory.dmp

Filesize
172KB

Download
memory/3412-140-0x0000000000000000-mapping.dmp

Download
memory/4056-133-0x0000000000500000-0x000000000052B000-memory.dmp

Filesize
172KB

Download
memory/4056-137-0x00000000004C0000-0x00000000004D4000-memory.dmp

Filesize
80KB

Download
memory/4056-132-0x00000000004C0000-0x00000000004D4000-memory.dmp

Filesize
80KB

Download
memory/4252-156-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/4252-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads