759cc0adf3f2ba76ea46946c7bfb1029ad8eb0b6a3c1b3601f13aa312a2f0eb4

Analysis

max time kernel
69s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2023 16:30

Target

44d370f942987d9128b412435dbc50a22566c8fdce819d84568c4c1606c3e466.dll
Size

13KB
MD5

25a370c5900d725fbc40518c41723a31
SHA1

ec964c63f84e019da9f3e93dd299a69e89fbcfb5
SHA256

44d370f942987d9128b412435dbc50a22566c8fdce819d84568c4c1606c3e466
SHA512

fb32d8ddac17adbb9eedb06ef46fd1bf7cbd72222b23c813175e9e4b7906752bb13edb2eb1534b0ddf2ec46e002c2908ea7136246dff6d5b89648b2a179f68e4
SSDEEP

192:UHlyEnTXZ1eMLfEYzHfdgyVQ0PQ+t4XbLVOOG9bBytrP0:sl/TXZ0MQYzHfdgyy0/8bUOG9b8P

Score

8^/10

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

16 4664 rundll32.exe
Modifies registry class 1 IoCs

Processes:

OpenWith.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings OpenWith.exe
Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

3992 NOTEPAD.EXE

flow	pid	process
16	4664	rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	OpenWith.exe

pid	process
3992	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

rundll32.exeOpenWith.exe

description	pid	process	target process
PID 1436 wrote to memory of 4664	1436	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 4664	1436	rundll32.exe	rundll32.exe
PID 1436 wrote to memory of 4664	1436	rundll32.exe	rundll32.exe
PID 4172 wrote to memory of 3992	4172	OpenWith.exe	NOTEPAD.EXE
PID 4172 wrote to memory of 3992	4172	OpenWith.exe	NOTEPAD.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44d370f942987d9128b412435dbc50a22566c8fdce819d84568c4c1606c3e466.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\44d370f942987d9128b412435dbc50a22566c8fdce819d84568c4c1606c3e466.dll,#1
2⤵
- Blocklisted process makes network request
PID:4664

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3088

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\44d370f942987d9128b412435dbc50a22566c8fdce819d84568c4c1606c3e466.dll
2⤵
- Opens file in notepad (likely ransom note)
PID:3992