77eb1714a4eb6c8c138e3a013bb20633122039a71c46d7b579722baaa91c0f34 | Triage

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2023 06:34

Sharing

Report Analysis Logs

General

Target

socks32_tor.dll
Size

31KB
MD5

ab2358024b8fa1f8d2ba06ff7980734f
SHA1

ee98a887090a0d04408d23ffb87fe933b2287107
SHA256

77eb1714a4eb6c8c138e3a013bb20633122039a71c46d7b579722baaa91c0f34
SHA512

a0958ac9ea9329ff6026ab22ce733970edc4e3604cbc5179c45ac76859789377e9fcdc704c04be30527e75cb362118bbcd8dc3022931111eb66cf9766ee02e74
SSDEEP

768:bS8Mc/ReGneyfP5iqiWsNhGDoh2EfoJdmA:8c/ReGnnhig4Lh2Efo

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 14 IoCs

Processes:

rundll32.exe

flow	pid	process
20	3332	rundll32.exe
30	3332	rundll32.exe
33	3332	rundll32.exe
40	3332	rundll32.exe
51	3332	rundll32.exe
55	3332	rundll32.exe
57	3332	rundll32.exe
59	3332	rundll32.exe
60	3332	rundll32.exe
61	3332	rundll32.exe
62	3332	rundll32.exe
63	3332	rundll32.exe
64	3332	rundll32.exe
65	3332	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 3332	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 3332	2028	rundll32.exe	rundll32.exe
PID 2028 wrote to memory of 3332	2028	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\socks32_tor.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\socks32_tor.dll,#1
2⤵
- Blocklisted process makes network request
PID:3332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads