f72851395ede7b5aca8e4bd8373f4368495c2d0e4097bf3bbec6ae9cc270fd43

Analysis

max time kernel
32s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f72851395ede7b5aca8e4bd8373f4368495c2d0e4097bf3bbec6ae9cc270fd43.dll
Size

22KB
MD5

27c823bb7c1325b15a642b8faf12acaf
SHA1

8793755ae5b82fb312a462a22d53ee95553815ec
SHA256

f72851395ede7b5aca8e4bd8373f4368495c2d0e4097bf3bbec6ae9cc270fd43
SHA512

78c16be0388bf482c11f77e20c4b10a91406e1f68c4b1b1cb6b004d68346cf6b6924b652f8e6e4190049adadefe973b07f69e9d457db6859888427103127a65c
SSDEEP

384:7YSDNDTqc1DumDUWx23R6KHJEn5B/f3wPBKXih/M/W73BROjS9XcEB3z/F/QMHKs:7YSDg+h23RXAwBDm+9XfV/FNqVVY

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1376	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	rundll32.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1492 wrote to memory of 1376	1492	rundll32.exe	28
PID 1376 wrote to memory of 260	1376	rundll32.exe	7
PID 1376 wrote to memory of 332	1376	rundll32.exe	6
PID 1376 wrote to memory of 368	1376	rundll32.exe	5
PID 1376 wrote to memory of 376	1376	rundll32.exe	4
PID 1376 wrote to memory of 408	1376	rundll32.exe	3
PID 1376 wrote to memory of 464	1376	rundll32.exe	2
PID 1376 wrote to memory of 472	1376	rundll32.exe	1
PID 1376 wrote to memory of 480	1376	rundll32.exe	8
PID 1376 wrote to memory of 588	1376	rundll32.exe	26
PID 1376 wrote to memory of 668	1376	rundll32.exe	25
PID 1376 wrote to memory of 744	1376	rundll32.exe	24
PID 1376 wrote to memory of 808	1376	rundll32.exe	23
PID 1376 wrote to memory of 844	1376	rundll32.exe	22
PID 1376 wrote to memory of 872	1376	rundll32.exe	21
PID 1376 wrote to memory of 300	1376	rundll32.exe	20
PID 1376 wrote to memory of 296	1376	rundll32.exe	19
PID 1376 wrote to memory of 1044	1376	rundll32.exe	18
PID 1376 wrote to memory of 1232	1376	rundll32.exe	9
PID 1376 wrote to memory of 1320	1376	rundll32.exe	17
PID 1376 wrote to memory of 1384	1376	rundll32.exe	16
PID 1376 wrote to memory of 1552	1376	rundll32.exe	14
PID 1376 wrote to memory of 1656	1376	rundll32.exe	13
PID 1376 wrote to memory of 1412	1376	rundll32.exe	12
PID 1376 wrote to memory of 1636	1376	rundll32.exe	11
PID 1376 wrote to memory of 1492	1376	rundll32.exe	27

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:472

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1232
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1656
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1552
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1044
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:296
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:300
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:872
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:844
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:668
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:588

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:408

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:376
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:480

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:368

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1636

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1412

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1384
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f72851395ede7b5aca8e4bd8373f4368495c2d0e4097bf3bbec6ae9cc270fd43.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\f72851395ede7b5aca8e4bd8373f4368495c2d0e4097bf3bbec6ae9cc270fd43.dll,#1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1376

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/260-56-0x0000000013120000-0x0000000013129000-memory.dmp

Filesize
36KB

Download
memory/1376-55-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download