Analysis

  • max time kernel
    33s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 16:20

General

  • Target

    a250fbe9d5ac179946d1f0e5566379993e0e57d0f2d972566923a8955183bd2f.dll

  • Size

    184KB

  • MD5

    84f349349a993a241f85aa00dfa3a135

  • SHA1

    faab3b480e0ec38d9072c1902b682f4056a6016b

  • SHA256

    a250fbe9d5ac179946d1f0e5566379993e0e57d0f2d972566923a8955183bd2f

  • SHA512

    82b7851db79b69947cf47a56903dde952b4165206b713af49ffe36f1e49c7af27f47b36e1ac5bb08a726dedca87389227db3f329b76304f08d1bfaf7aa15a9a0

  • SSDEEP

    3072:TfCqREdkBOmp7h5r6POcnmMT35xqppRpm2Xc/erSr3O8bkuHnN:TfCyEdkBOmxWPbnm62pvm8c/erSr3OEX

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\a250fbe9d5ac179946d1f0e5566379993e0e57d0f2d972566923a8955183bd2f.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\a250fbe9d5ac179946d1f0e5566379993e0e57d0f2d972566923a8955183bd2f.dll,#1
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1536-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

    Filesize

    8KB

  • memory/1536-56-0x0000000000240000-0x0000000000265000-memory.dmp

    Filesize

    148KB

  • memory/1536-57-0x00000000002E0000-0x0000000000305000-memory.dmp

    Filesize

    148KB

  • memory/1536-58-0x00000000002E0000-0x0000000000305000-memory.dmp

    Filesize

    148KB

  • memory/1536-59-0x00000000002E0000-0x0000000000305000-memory.dmp

    Filesize

    148KB

  • memory/1536-60-0x00000000002E0000-0x0000000000305000-memory.dmp

    Filesize

    148KB

  • memory/1536-61-0x00000000002E0000-0x0000000000305000-memory.dmp

    Filesize

    148KB

  • memory/1536-62-0x00000000002E0000-0x0000000000305000-memory.dmp

    Filesize

    148KB

  • memory/1536-63-0x00000000002E0000-0x0000000000305000-memory.dmp

    Filesize

    148KB