d1ab4605daa8058e82986263bd4467fee9942a0bce7feda699a18694118484c9

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24/04/2023, 10:11

Target

d1ab4605daa8058e82986263bd4467fee9942a0bce7feda699a18694118484c9.dll
Size

239KB
MD5

be098c5d182efddfdce03c36b53d2452
SHA1

676206ab6ca818ddc6fea477a6c924a49ff884c1
SHA256

d1ab4605daa8058e82986263bd4467fee9942a0bce7feda699a18694118484c9
SHA512

f6ad0652f8313dd0c78debb1a30b282e43002c45f767727003e65ddc1ac18fd18bbc7da4d1ca2a05e6bcbb4433956bf7db7f7cce0986f95addb55c01853961a4
SSDEEP

6144:T0zXC1Rt2XFWqeo1w3BPd5jGiegwYkQVI4En48ukBptPVUFwfR:T2C12XkqEd5jGiegwYkQVI4En48xpVGO

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1ab4605daa8058e82986263bd4467fee9942a0bce7feda699a18694118484c9.dll,#1
1⤵
- Writes to the Master Boot Record (MBR)
PID:920

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact