Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/02/2023, 21:15

General

  • Target

    based.dll

  • Size

    215KB

  • MD5

    e5de5a1548715bd431e803a68ef42f89

  • SHA1

    37d3b009182161ad48dee19b67ed4856ac610e8a

  • SHA256

    57106a8bd5f4ec86636ad8690232ada2c9b12de029e9ff5fecc36345286a16b1

  • SHA512

    019dde503547a2caa0695c751620ea149840edee1454c65b300b96784c65a8c57373e33a8f841523caf4c1c22542a955f54bfedb7217b47b13e1886604788db8

  • SSDEEP

    3072:ImjMTWEQjIB7zr75ixph0LR/hSMXlk4ZqKFya5XB67TzKwLVF8:eWRIBBKph0lhSMXlBXBWHLLVe

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\based.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\based.dll,#1
      2⤵
        PID:2840
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 620
          3⤵
          • Program crash
          PID:4720

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2840-121-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-122-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-123-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-124-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-125-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-126-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-127-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-128-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-129-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-130-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-131-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-132-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-133-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-134-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-136-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-137-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-135-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-138-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-139-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-140-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-141-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-142-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-143-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-144-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-145-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-146-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-147-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-149-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-148-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-150-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-151-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-152-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-153-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-154-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-157-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-156-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-158-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-155-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-159-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-160-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-161-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-162-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-163-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-164-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-165-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB

    • memory/2840-166-0x0000000077710000-0x000000007789E000-memory.dmp

      Filesize

      1.6MB