fd4719b6df0776382f0d5b3a0a6a90ff8eb77afc0214a8cba1ae1933c295bc8d

Analysis

max time kernel
105s
max time network
274s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd4719b6df0776382f0d5b3a0a6a90ff8eb77afc0214a8cba1ae1933c295bc8d.dll
Size

62KB
MD5

1ef96379f3c1725d4961b0599d5aa931
SHA1

c04faa68d5d4f0ef8f23dcc1db0a199db738d0f7
SHA256

fd4719b6df0776382f0d5b3a0a6a90ff8eb77afc0214a8cba1ae1933c295bc8d
SHA512

04c7f5e391a74119255a31daa97105199b1260e8262a599cac4538048bcdc06668950c4e0141417cad578fab454934b787e62b3a8b2922c621546c0c95007f63
SSDEEP

1536:eQVfezDhX6HABLMMcJoz7LJLleOOtJ5ZhFn0wcccccccc:vqYAdUJW7L1leOOL5PFn0wcccccccc

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	1692	rundll32.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\inetpack.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\inetpack.dll	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1692	948	rundll32.exe	28
PID 948 wrote to memory of 1692	948	rundll32.exe	28
PID 948 wrote to memory of 1692	948	rundll32.exe	28
PID 948 wrote to memory of 1692	948	rundll32.exe	28
PID 948 wrote to memory of 1692	948	rundll32.exe	28
PID 948 wrote to memory of 1692	948	rundll32.exe	28
PID 948 wrote to memory of 1692	948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd4719b6df0776382f0d5b3a0a6a90ff8eb77afc0214a8cba1ae1933c295bc8d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd4719b6df0776382f0d5b3a0a6a90ff8eb77afc0214a8cba1ae1933c295bc8d.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  PID:1692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1692-54-0x0000000000000000-mapping.dmp

Download
memory/1692-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1692-56-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download