77eb1714a4eb6c8c138e3a013bb20633122039a71c46d7b579722baaa91c0f34 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-05-2023 06:34

Sharing

Report Analysis Logs

General

Target

socks32_tor.dll
Size

31KB
MD5

ab2358024b8fa1f8d2ba06ff7980734f
SHA1

ee98a887090a0d04408d23ffb87fe933b2287107
SHA256

77eb1714a4eb6c8c138e3a013bb20633122039a71c46d7b579722baaa91c0f34
SHA512

a0958ac9ea9329ff6026ab22ce733970edc4e3604cbc5179c45ac76859789377e9fcdc704c04be30527e75cb362118bbcd8dc3022931111eb66cf9766ee02e74
SSDEEP

768:bS8Mc/ReGneyfP5iqiWsNhGDoh2EfoJdmA:8c/ReGnnhig4Lh2Efo

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 14 IoCs

Processes:

rundll32.exe

flow	pid	process
1	1184	rundll32.exe
2	1184	rundll32.exe
4	1184	rundll32.exe
5	1184	rundll32.exe
6	1184	rundll32.exe
7	1184	rundll32.exe
8	1184	rundll32.exe
9	1184	rundll32.exe
10	1184	rundll32.exe
11	1184	rundll32.exe
12	1184	rundll32.exe
13	1184	rundll32.exe
14	1184	rundll32.exe
15	1184	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1188 wrote to memory of 1184	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1184	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1184	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1184	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1184	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1184	1188	rundll32.exe	rundll32.exe
PID 1188 wrote to memory of 1184	1188	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\socks32_tor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\socks32_tor.dll,#1
2⤵
- Blocklisted process makes network request
PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...