Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
16-02-2023 19:27
Behavioral task
behavioral1
Sample
cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9.dll
Resource
win10v2004-20221111-en
General
-
Target
cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9.dll
-
Size
419KB
-
MD5
d644f4c6e336234d358cb4171cab4fab
-
SHA1
93def80398c6c69089d84225c253f323ca6d120e
-
SHA256
cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9
-
SHA512
6c8ee543a1d29f88f17c4ea70592f25131122e1c4ca21aa48fab1982bb8766e04f77a5c797368ec7be5c7e30d1b05cd8dbc4671af7b0abcd488962dbb1c9659d
-
SSDEEP
12288:tG3Z4xjHybY0uLJRA/1R39DFSJud2aXjyQY:tGp6jHgG3aVBQudFfY
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 2016 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2004 wrote to memory of 2016 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2016 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2016 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2016 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2016 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2016 2004 rundll32.exe rundll32.exe PID 2004 wrote to memory of 2016 2004 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cfe53109c58cfb593cf8864dc9e5b50dfb269c7d986af7ff7c356a844a3036f9.dll,#12⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2016-54-0x0000000000000000-mapping.dmp
-
memory/2016-55-0x00000000760C1000-0x00000000760C3000-memory.dmpFilesize
8KB
-
memory/2016-57-0x0000000010000000-0x0000000010109000-memory.dmpFilesize
1.0MB
-
memory/2016-58-0x0000000010000000-0x0000000010109000-memory.dmpFilesize
1.0MB
-
memory/2016-56-0x0000000010000000-0x0000000010109000-memory.dmpFilesize
1.0MB
-
memory/2016-59-0x0000000010000000-0x0000000010109000-memory.dmpFilesize
1.0MB
-
memory/2016-60-0x0000000010000000-0x0000000010109000-memory.dmpFilesize
1.0MB