2aca3e65d0635b1d0c90de716f495c118a32d408e012f135f9845625382e5aa9

Analysis

max time kernel
183s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 02:05

Target

2aca3e65d0635b1d0c90de716f495c118a32d408e012f135f9845625382e5aa9.dll
Size

52KB
MD5

948122d20511b0a8f01813028f35cf00
SHA1

9dfe671b6966fe01c92a64ac85c5f22a79de2c5e
SHA256

2aca3e65d0635b1d0c90de716f495c118a32d408e012f135f9845625382e5aa9
SHA512

ad245b03dd1d9fab02e4b4212d723cc364e1357c26ad0a584876450c735dcd86babcddcce4a37914cfc2d6e5e4cf2fc7f23bf963ee992b1fcb89eaf40a5ed75f
SSDEEP

768:xyO5cc6i3TJqHkwMzLV/ZdMIqTjG/82pR0QZhd+zPjKunTED4tWLwEcQ:xiri3EHk7h/ZdMMeQUzP5BG

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2164	2280	rundll32.exe	80
PID 2280 wrote to memory of 2164	2280	rundll32.exe	80
PID 2280 wrote to memory of 2164	2280	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aca3e65d0635b1d0c90de716f495c118a32d408e012f135f9845625382e5aa9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aca3e65d0635b1d0c90de716f495c118a32d408e012f135f9845625382e5aa9.dll,#1
  2⤵
  - Modifies registry class
  PID:2164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4868

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact