0bb78df6c8e049c7a33d2656555e15388a59ee96bde6f221ac5494b959cd60eb | Triage

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09/05/2023, 04:53

Sharing

Report Analysis Logs

General

Target

socks32_tor.dll
Size

31KB
MD5

ab2358024b8fa1f8d2ba06ff7980734f
SHA1

ee98a887090a0d04408d23ffb87fe933b2287107
SHA256

77eb1714a4eb6c8c138e3a013bb20633122039a71c46d7b579722baaa91c0f34
SHA512

a0958ac9ea9329ff6026ab22ce733970edc4e3604cbc5179c45ac76859789377e9fcdc704c04be30527e75cb362118bbcd8dc3022931111eb66cf9766ee02e74
SSDEEP

768:bS8Mc/ReGneyfP5iqiWsNhGDoh2EfoJdmA:8c/ReGnnhig4Lh2Efo

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 14 IoCs

flow	pid	Process
1	2000	rundll32.exe
2	2000	rundll32.exe
4	2000	rundll32.exe
5	2000	rundll32.exe
6	2000	rundll32.exe
7	2000	rundll32.exe
8	2000	rundll32.exe
9	2000	rundll32.exe
10	2000	rundll32.exe
11	2000	rundll32.exe
12	2000	rundll32.exe
13	2000	rundll32.exe
14	2000	rundll32.exe
15	2000	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2000	2020	rundll32.exe	27
PID 2020 wrote to memory of 2000	2020	rundll32.exe	27
PID 2020 wrote to memory of 2000	2020	rundll32.exe	27
PID 2020 wrote to memory of 2000	2020	rundll32.exe	27
PID 2020 wrote to memory of 2000	2020	rundll32.exe	27
PID 2020 wrote to memory of 2000	2020	rundll32.exe	27
PID 2020 wrote to memory of 2000	2020	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\socks32_tor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\socks32_tor.dll,#1
  2⤵
  - Blocklisted process makes network request
  PID:2000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads