33b3c5f201315a79e77d01c369ac6753ebfa55b6a99311abf922e6dcc99c0776

Analysis

max time kernel
181s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 07:02

Target

33b3c5f201315a79e77d01c369ac6753ebfa55b6a99311abf922e6dcc99c0776.dll
Size

78KB
MD5

91ff2b57646f55e8f16306480de7e330
SHA1

4074a409e637e1266dae351beaaaeab359921728
SHA256

33b3c5f201315a79e77d01c369ac6753ebfa55b6a99311abf922e6dcc99c0776
SHA512

44a3ee318ae738bca11fe85ad6cfd2c3995a50247e0af0af7ac74ec211fc02dab268ea0415eaa443d517f4fc87ffecefc8347b659ddded76a6e963b04ad8c420
SSDEEP

1536:baQkEpZZsW1kLY8WkzxkjTcCGe+w9dycD6z/IUxKXT/TwfZ+:PsW2mkmjXGRw9dycDDEiT8fZ+

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aqetovo = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\33b3c5f201315a79e77d01c369ac6753ebfa55b6a99311abf922e6dcc99c0776.dll\",Startup"	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
468	632	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 972 wrote to memory of 956	972	rundll32.exe	28
PID 956 wrote to memory of 632	956	rundll32.exe	29
PID 956 wrote to memory of 632	956	rundll32.exe	29
PID 956 wrote to memory of 632	956	rundll32.exe	29
PID 956 wrote to memory of 632	956	rundll32.exe	29
PID 956 wrote to memory of 632	956	rundll32.exe	29
PID 956 wrote to memory of 632	956	rundll32.exe	29
PID 956 wrote to memory of 632	956	rundll32.exe	29
PID 632 wrote to memory of 468	632	rundll32.exe	30
PID 632 wrote to memory of 468	632	rundll32.exe	30
PID 632 wrote to memory of 468	632	rundll32.exe	30
PID 632 wrote to memory of 468	632	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33b3c5f201315a79e77d01c369ac6753ebfa55b6a99311abf922e6dcc99c0776.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\33b3c5f201315a79e77d01c369ac6753ebfa55b6a99311abf922e6dcc99c0776.dll,#1
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\33b3c5f201315a79e77d01c369ac6753ebfa55b6a99311abf922e6dcc99c0776.dll",iep
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 632 -s 336
      4⤵
      Program crash
      PID:468

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/632-67-0x00000000006B0000-0x00000000006F0000-memory.dmp

Filesize
256KB

Download
memory/632-69-0x00000000006B0000-0x00000000006F0000-memory.dmp

Filesize
256KB

Download
memory/956-55-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000010001000-0x000000001000D000-memory.dmp

Filesize
48KB

Download
memory/956-58-0x0000000010001000-0x000000001000D000-memory.dmp

Filesize
48KB

Download
memory/956-57-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/956-60-0x0000000000261000-0x000000000026E000-memory.dmp

Filesize
52KB

Download