050a3db985fe0180e985301a918783faea7dd720cb7259c597f1ef5a0dad325a

Analysis

max time kernel
143s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2023 14:29

Target

winthrusterpropj/HookDLL/H_Hayat_x32.dll
Size

15KB
MD5

fb6220758edfa39039e72a39ca14f66e
SHA1

d129c107e6eef34dc9ee45ead2a9266a9d9f5c0a
SHA256

567559749b615f54722897814baa4ab7e5c51caef0704805cc04aa1bc89f99eb
SHA512

d759b5692cfc5efdfdc167ee1747726a7082c71b43dccab650f8096fff9b2fcb2ac824f0c9353c0acfdcdbb83deef32696a0ae5fdd04a2ceb4047c659f315524
SSDEEP

384:gVeKO4bBl0324W1MeHwy3prDcquLaKUAqgT5TprWG:oeKO442X5DcquLaKU3gW

Score

6^/10

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

rundll32.exe

description ioc process

File opened (read-only) \??\N: rundll32.exe

description	ioc	process
File opened (read-only)	\??\N:	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3800 wrote to memory of 2976	3800	rundll32.exe	rundll32.exe
PID 3800 wrote to memory of 2976	3800	rundll32.exe	rundll32.exe
PID 3800 wrote to memory of 2976	3800	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\winthrusterpropj\HookDLL\H_Hayat_x32.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\winthrusterpropj\HookDLL\H_Hayat_x32.dll,#1
2⤵
- Enumerates connected drives
PID:2976

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2976-133-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download