Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-05-2023 00:34
Behavioral task
behavioral1
Sample
c84c24ce3480cf421e840a371bedaede99426ad728d882eb6a191063eadf207d.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c84c24ce3480cf421e840a371bedaede99426ad728d882eb6a191063eadf207d.dll
Resource
win10v2004-20230220-en
General
-
Target
c84c24ce3480cf421e840a371bedaede99426ad728d882eb6a191063eadf207d.dll
-
Size
444KB
-
MD5
0334867c00116b719ab7c75efada0e40
-
SHA1
01158db255aa9d2b0b79b28f4c4023f4fc1337dd
-
SHA256
c84c24ce3480cf421e840a371bedaede99426ad728d882eb6a191063eadf207d
-
SHA512
d00eeea07b1cde1868c3071776b47d26567c28e130974c25f09eacde144221eaa421f3a57ba246bb7a50936a17d19ae1366e0f1d79f761dd6362425ba21fc107
-
SSDEEP
12288:Cg2DW0V9+ANNsOu0tJc6emAOsjnLPgRqmbOe/J:uW0/+AfsOuIuOsLL3mae/J
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rundll32.exepid process 1396 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1276 wrote to memory of 1396 1276 rundll32.exe rundll32.exe PID 1276 wrote to memory of 1396 1276 rundll32.exe rundll32.exe PID 1276 wrote to memory of 1396 1276 rundll32.exe rundll32.exe PID 1276 wrote to memory of 1396 1276 rundll32.exe rundll32.exe PID 1276 wrote to memory of 1396 1276 rundll32.exe rundll32.exe PID 1276 wrote to memory of 1396 1276 rundll32.exe rundll32.exe PID 1276 wrote to memory of 1396 1276 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c84c24ce3480cf421e840a371bedaede99426ad728d882eb6a191063eadf207d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c84c24ce3480cf421e840a371bedaede99426ad728d882eb6a191063eadf207d.dll,#12⤵
- Suspicious use of SetWindowsHookEx
PID:1396
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1396-55-0x0000000010000000-0x0000000010112000-memory.dmpFilesize
1.1MB
-
memory/1396-56-0x0000000010000000-0x0000000010112000-memory.dmpFilesize
1.1MB
-
memory/1396-54-0x0000000010000000-0x0000000010112000-memory.dmpFilesize
1.1MB
-
memory/1396-57-0x0000000010000000-0x0000000010112000-memory.dmpFilesize
1.1MB