039081a7cb928e609cb768a3ae9276e1ee0d011ac2b52e423d00657e7e7cfe18

Analysis

max time kernel
26s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 02:07

Target

039081a7cb928e609cb768a3ae9276e1ee0d011ac2b52e423d00657e7e7cfe18.dll
Size

52KB
MD5

c0c42990953398059bac147133140290
SHA1

49cf0c3762f53704e5fe41990b38829d846bac3e
SHA256

039081a7cb928e609cb768a3ae9276e1ee0d011ac2b52e423d00657e7e7cfe18
SHA512

d9ea8a9884df33fe7cd38a061c38b4eefecc0ce95ca9d620a437dfdd475bbe118ef9472849066b81564db554a9e1b9cd941b28e92ed083d09db0d760f7252496
SSDEEP

768:UyOMccqi3TJq3kQMXrV/Jd8IqTjGqMW5B0QZhd+zPdCunTEDs6LLwhc6:Udbi3E3kvB/Jd89uQUzPdl/R/

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 872	1676	rundll32.exe	28
PID 1676 wrote to memory of 872	1676	rundll32.exe	28
PID 1676 wrote to memory of 872	1676	rundll32.exe	28
PID 1676 wrote to memory of 872	1676	rundll32.exe	28
PID 1676 wrote to memory of 872	1676	rundll32.exe	28
PID 1676 wrote to memory of 872	1676	rundll32.exe	28
PID 1676 wrote to memory of 872	1676	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\039081a7cb928e609cb768a3ae9276e1ee0d011ac2b52e423d00657e7e7cfe18.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\039081a7cb928e609cb768a3ae9276e1ee0d011ac2b52e423d00657e7e7cfe18.dll,#1
  2⤵
  PID:872

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/872-55-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/872-56-0x00000000745C1000-0x00000000745C3000-memory.dmp

Filesize
8KB

Download