Analysis
- max time kernel
38s - max time network
44s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
23/01/2023, 19:10
General
- Target 333bdb430f49f558e78ccf6e759c9da4.exe
- Size 3.7MB
- Sample230123-xvertseh66
- SHA256 2a928111da98db071d4e02e581f00626c3b9bd6fd7c5c46f04367a633eee91f2
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\333bdb430f49f558e78ccf6e759c9da4.exe"C:\Users\Admin\AppData\Local\Temp\333bdb430f49f558e78ccf6e759c9da4.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Athusdiuuhasd.dll,start2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Athusdiuuhasd.dll
Athusdiuuhasd.dll
Athusdiuuhasd.dll
Athusdiuuhasd.dll
Athusdiuuhasd.dll
memory/1096-57-0x0000000004CD0000-0x00000000051C0000-memory.dmp
memory/1096-58-0x0000000000400000-0x0000000002F19000-memory.dmp
memory/1096-66-0x0000000000400000-0x0000000002F19000-memory.dmp
memory/1096-54-0x00000000768A1000-0x00000000768A3000-memory.dmp
memory/1096-56-0x0000000004930000-0x0000000004CC1000-memory.dmp
memory/1096-55-0x0000000004930000-0x0000000004CC1000-memory.dmp
memory/1796-67-0x0000000001EF0000-0x000000000235E000-memory.dmp
memory/1796-68-0x0000000001EF0000-0x000000000235E000-memory.dmp
memory/1796-69-0x0000000001EF0000-0x000000000235E000-memory.dmp