8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e

Analysis

max time kernel
46s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 04:51

Target

8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e.dll
Size

64KB
MD5

32cf3b4c18026ad64044a0227debdb4a
SHA1

6fda41e17fffa525f4ffe874468ee13d94e75c76
SHA256

8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e
SHA512

db1ff6a52fa70f1ad0ee06e910c3d1e53e80db44960b15c865241aa2d1e7bfd724cfa66cb01b6389381359bf8a1973d22b020c381fde5f8dd50bc48bb83fbe9b
SSDEEP

768:JUCK7zpR9yaktKTBEHtxiXGLvaXouTSfbN5HwQmvge7tmUROeEJ9y59oUS28:MXknWGa4uT2Z5HwkIEJ09ob28

Score

8^/10

persistence

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Suspicious behavior: EnumeratesProcesses 29 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27
PID 1500 wrote to memory of 1932	1500	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d1f7b8b1493974ed50b619aa8d0f04c088652772a034eef34ca2ac32d5adc1e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1932-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download