44981b4d3b07d44093bcbb5046c91186e60dd233260235a562cde433aa2dffac

Analysis

max time kernel
37s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

44981b4d3b07d44093bcbb5046c91186e60dd233260235a562cde433aa2dffac.dll
Size

208KB
MD5

4059871f6e813e90288383136ae98090
SHA1

b9bd9d073b260705192f23956bf9baaaf78f2d03
SHA256

44981b4d3b07d44093bcbb5046c91186e60dd233260235a562cde433aa2dffac
SHA512

d0a7372d63ab9cd40daffc1bb2db26f0a0195355bbef62562c2ca5fd79c58eff514ec6177e186349d85405f5b1c694de1ca90f462fab5226f2d0380c93459e9d
SSDEEP

3072:hs0JB2GYMkqNp42oZqI+fugiycy48C1Xf53ZIU2WSS2jbxWGqt7:jBAMNp42fug301vL725SbGq1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1488	900	rundll32.exe	27
PID 900 wrote to memory of 1488	900	rundll32.exe	27
PID 900 wrote to memory of 1488	900	rundll32.exe	27
PID 900 wrote to memory of 1488	900	rundll32.exe	27
PID 900 wrote to memory of 1488	900	rundll32.exe	27
PID 900 wrote to memory of 1488	900	rundll32.exe	27
PID 900 wrote to memory of 1488	900	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44981b4d3b07d44093bcbb5046c91186e60dd233260235a562cde433aa2dffac.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\44981b4d3b07d44093bcbb5046c91186e60dd233260235a562cde433aa2dffac.dll,#1
  2⤵
  - Enumerates system info in registry
  PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1488-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download
memory/1488-57-0x00000000007E0000-0x000000000080B000-memory.dmp

Filesize
172KB

Download
memory/1488-56-0x00000000007E0000-0x000000000080B000-memory.dmp

Filesize
172KB

Download
memory/1488-58-0x0000000000310000-0x000000000033B000-memory.dmp

Filesize
172KB

Download