0909322dede6d2639bc5aba3de6bbe4a6b9552df002547378c35629b1ceefedf

Analysis

max time kernel
60s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.6MB
Sample221129-sflvdaaf87
SHA256 0909322dede6d2639bc5aba3de6bbe4a6b9552df002547378c35629b1ceefedf
MD5 6e2b9256f691caef06f67960b0816391
SHA1 0fb9bf1dc40a945fa04083644b4800574b6b619a
SHA512 23614ce8a324d4a0d54acb9b2427eaf37a3534ba23040c8a484f00da36714a991de5637f6cc72e9b45e709f1f94e4086f390ea3615f01013fcd1629cbe81933d
SSDEEP 98304:08AxfdECV5367x4LPwQ3wk6CTkv9hldFOKc8/oXyk8h3gPFzQ85C:08Axfhjjv6CTgRFOKXdthGFc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
1580	rundll32.exe
1580	rundll32.exe
1580	rundll32.exe
1580	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1580	1224	file.exe	28
PID 1224 wrote to memory of 1580	1224	file.exe	28
PID 1224 wrote to memory of 1580	1224	file.exe	28
PID 1224 wrote to memory of 1580	1224	file.exe	28
PID 1224 wrote to memory of 1580	1224	file.exe	28
PID 1224 wrote to memory of 1580	1224	file.exe	28
PID 1224 wrote to memory of 1580	1224	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll,start
  2⤵
  - Loads dropped DLL
  PID:1580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Serpodtudpwhhta.dll

Path C:\Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll
Size 4.3MB
SHA256 10a74491f85dda0e42a9848cba6723ca683c5f82c07840b22a7929e795909b8c
MD5 55cba6f8eebf48d13ccd7a4abb32d50a
SHA1 db2d4ad4d21156a6a688b5530b0667b5973e3096
SHA512 fc16310950dddaa7a536ac712fb9e4107ff4c84323a476b42e32dadfc161c4a4335be8eca1e2e71d9dc1e59ff4485ddc04c88bbe1fd72fa36ae05ce3871ef263
SSDEEP 98304:2Ekp3AUUgGFofLw++PxAbc5rh5Ar/04TA7P:gp31UtFmLw95Abc5rh5Ar/NTA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Serpodtudpwhhta.dll

Path \Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll
Size 4.3MB
SHA256 10a74491f85dda0e42a9848cba6723ca683c5f82c07840b22a7929e795909b8c
MD5 55cba6f8eebf48d13ccd7a4abb32d50a
SHA1 db2d4ad4d21156a6a688b5530b0667b5973e3096
SHA512 fc16310950dddaa7a536ac712fb9e4107ff4c84323a476b42e32dadfc161c4a4335be8eca1e2e71d9dc1e59ff4485ddc04c88bbe1fd72fa36ae05ce3871ef263
SSDEEP 98304:2Ekp3AUUgGFofLw++PxAbc5rh5Ar/04TA7P:gp31UtFmLw95Abc5rh5Ar/NTA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Serpodtudpwhhta.dll

Path \Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll
Size 4.3MB
SHA256 10a74491f85dda0e42a9848cba6723ca683c5f82c07840b22a7929e795909b8c
MD5 55cba6f8eebf48d13ccd7a4abb32d50a
SHA1 db2d4ad4d21156a6a688b5530b0667b5973e3096
SHA512 fc16310950dddaa7a536ac712fb9e4107ff4c84323a476b42e32dadfc161c4a4335be8eca1e2e71d9dc1e59ff4485ddc04c88bbe1fd72fa36ae05ce3871ef263
SSDEEP 98304:2Ekp3AUUgGFofLw++PxAbc5rh5Ar/04TA7P:gp31UtFmLw95Abc5rh5Ar/NTA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Serpodtudpwhhta.dll

Path \Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll
Size 4.3MB
SHA256 10a74491f85dda0e42a9848cba6723ca683c5f82c07840b22a7929e795909b8c
MD5 55cba6f8eebf48d13ccd7a4abb32d50a
SHA1 db2d4ad4d21156a6a688b5530b0667b5973e3096
SHA512 fc16310950dddaa7a536ac712fb9e4107ff4c84323a476b42e32dadfc161c4a4335be8eca1e2e71d9dc1e59ff4485ddc04c88bbe1fd72fa36ae05ce3871ef263
SSDEEP 98304:2Ekp3AUUgGFofLw++PxAbc5rh5Ar/04TA7P:gp31UtFmLw95Abc5rh5Ar/NTA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Serpodtudpwhhta.dll

Path \Users\Admin\AppData\Local\Temp\Serpodtudpwhhta.dll
Size 4.3MB
SHA256 10a74491f85dda0e42a9848cba6723ca683c5f82c07840b22a7929e795909b8c
MD5 55cba6f8eebf48d13ccd7a4abb32d50a
SHA1 db2d4ad4d21156a6a688b5530b0667b5973e3096
SHA512 fc16310950dddaa7a536ac712fb9e4107ff4c84323a476b42e32dadfc161c4a4335be8eca1e2e71d9dc1e59ff4485ddc04c88bbe1fd72fa36ae05ce3871ef263
SSDEEP 98304:2Ekp3AUUgGFofLw++PxAbc5rh5Ar/04TA7P:gp31UtFmLw95Abc5rh5Ar/NTA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1224-58-0x0000000000400000-0x00000000008F2000-memory.dmp

Download

memory/1224-62-0x0000000002620000-0x0000000002B05000-memory.dmp

Download

memory/1224-54-0x0000000002290000-0x0000000002615000-memory.dmp

Download

memory/1224-57-0x0000000076041000-0x0000000076043000-memory.dmp

Download

memory/1224-56-0x0000000002620000-0x0000000002B05000-memory.dmp

Download

memory/1224-55-0x0000000002290000-0x0000000002615000-memory.dmp

Download

memory/1224-68-0x0000000000400000-0x00000000008F2000-memory.dmp

Download

memory/1580-67-0x0000000001FA0000-0x00000000023F7000-memory.dmp

Download

memory/1580-69-0x0000000001FA0000-0x00000000023F7000-memory.dmp

Download

memory/1580-70-0x0000000001FA0000-0x00000000023F7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads