4b0c130e570b39b6033addc57a54bc8c5b28ddebc1e7ab9a5e112af57e0cfafe

Analysis

max time kernel
153s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 02:51

Target

4b0c130e570b39b6033addc57a54bc8c5b28ddebc1e7ab9a5e112af57e0cfafe.dll
Size

25KB
MD5

4fbc45e4fbbfd205c712c688a3af4430
SHA1

48a359dd1a09a877fc5e380b80bdda9725b992b8
SHA256

4b0c130e570b39b6033addc57a54bc8c5b28ddebc1e7ab9a5e112af57e0cfafe
SHA512

a151a43149060d23d8c97e33b9ce0f54df397724b6b5c253cdcd1bb1c0ddb398339b8569196f2ddd9496ff6f4a2582dfe5d52f15bf5736f018736e448fa394d9
SSDEEP

768:K/UKWH/DsQJ872TeYojYEdIqmnCSsp8WivLvV:KtFayJjLHA1rV

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssgrate.exe = "C:\\Windows\\system32\\irun4.exe"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4116	4800	rundll32.exe	81
PID 4800 wrote to memory of 4116	4800	rundll32.exe	81
PID 4800 wrote to memory of 4116	4800	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c130e570b39b6033addc57a54bc8c5b28ddebc1e7ab9a5e112af57e0cfafe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b0c130e570b39b6033addc57a54bc8c5b28ddebc1e7ab9a5e112af57e0cfafe.dll,#1
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:4116

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4116-132-0x0000000000000000-mapping.dmp

Download
memory/4116-133-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download