11fdccffe090c2037b117a291498ebe73dcb76b943148c859d286e29aa0bde22

Analysis

max time kernel
30s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-04-2023 19:25

Target

11fdccffe090c2037b117a291498ebe73dcb76b943148c859d286e29aa0bde22.dll
Size

1016KB
MD5

54f516d438f8c934cca61260ca67f5cd
SHA1

1d1a37e2cad9fd1ceccf127a0013930a1157a4ba
SHA256

11fdccffe090c2037b117a291498ebe73dcb76b943148c859d286e29aa0bde22
SHA512

733804ae130f6a3118de66e0049fe8ee2cb2afe6dfe7e0d8c172d9faeeb3c4b26497a60590818e2f73bee08a1588892ff05bf1456142e620876ad5d8fa80e1d6
SSDEEP

12288:kerN2SjBsuKkMA+dSovI17FJIrUbhKF5WVkdAldU23kHhuDRtsT2N:kehNj+dTv27Xpb8FzdA/1kMDsT2N

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

rundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

2004 rundll32.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

pid	process
2004	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe
PID 1996 wrote to memory of 2004	1996	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\11fdccffe090c2037b117a291498ebe73dcb76b943148c859d286e29aa0bde22.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\11fdccffe090c2037b117a291498ebe73dcb76b943148c859d286e29aa0bde22.dll,#1
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:2004

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact