b951e68e8d077a77c3ae6711bdfb68a742efa414482a3cae747e931065afacc0

Analysis

max time kernel
188s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 00:06

Target

b951e68e8d077a77c3ae6711bdfb68a742efa414482a3cae747e931065afacc0.dll
Size

224KB
MD5

ed75f6336472487fbc859bf97fd3e090
SHA1

e5368cd4ce7f8bd511238e5fcac5b8f3fa696728
SHA256

b951e68e8d077a77c3ae6711bdfb68a742efa414482a3cae747e931065afacc0
SHA512

dc4c850e2f483dc739a17d25d7a376882de3aa1a17a2150795577c387811233ac7a88713671e8c4dd3a4072b89c0be157e5e26b158677af838c96cde9af42ef7
SSDEEP

6144:Tl2LDKM8EbwNICZdzCohcBSaGp9dYCIHX:k51CHzCo+BSacm

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Hmuvixivu = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\b951e68e8d077a77c3ae6711bdfb68a742efa414482a3cae747e931065afacc0.dll\",Startup"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1540	rundll32.exe
1540	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1540	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 1540	3636	rundll32.exe	81
PID 3636 wrote to memory of 1540	3636	rundll32.exe	81
PID 3636 wrote to memory of 1540	3636	rundll32.exe	81

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b951e68e8d077a77c3ae6711bdfb68a742efa414482a3cae747e931065afacc0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b951e68e8d077a77c3ae6711bdfb68a742efa414482a3cae747e931065afacc0.dll,#1
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1540

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1540-133-0x0000000010000000-0x0000000010049000-memory.dmp

Filesize
292KB

Download
memory/1540-136-0x00000000028D0000-0x00000000029D0000-memory.dmp

Filesize
1024KB

Download
memory/1540-137-0x00000000028D0000-0x00000000029D0000-memory.dmp

Filesize
1024KB

Download