e824693bc6a3853ec92348eb3b992b44f60559339c49e22c35b0a2e4e9d38b00

Analysis

max time kernel
180s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 07:59

Target

e824693bc6a3853ec92348eb3b992b44f60559339c49e22c35b0a2e4e9d38b00.dll
Size

424KB
MD5

914352a2d65e7e7097022da5b100d716
SHA1

7a6ab25058353e3340d791cf745f26e4095996bd
SHA256

e824693bc6a3853ec92348eb3b992b44f60559339c49e22c35b0a2e4e9d38b00
SHA512

dee205507220190116b4e850f8dfa4ee478ec8afab7a7bf13dd15db6c323383e68e4bb7c9804af5beb229611d81fc6ed627f8679acf58aeb4c193610ed019534
SSDEEP

12288:m2Qdb+1XlqlOBCmGQeIy2km+p8oOeTBgdg:m2NlqCCfIyHp8ongdg

Score

8^/10

Blocklisted process makes network request 11 IoCs

Processes:

rundll32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Drops file in System32 directory 2 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\54-21-2012 rundll32.exe
File created C:\Windows\SysWOW64\42f rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\54-21-2012	rundll32.exe
File created	C:\Windows\SysWOW64\42f	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2156 wrote to memory of 4180	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 4180	2156	rundll32.exe	rundll32.exe
PID 2156 wrote to memory of 4180	2156	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e824693bc6a3853ec92348eb3b992b44f60559339c49e22c35b0a2e4e9d38b00.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact