655981dd3a088e17a81047b84a862ed6ef356c75829dfc221f4317ec00d95754

Analysis

max time kernel
118s
max time network
149s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 11:42

Target

655981dd3a088e17a81047b84a862ed6ef356c75829dfc221f4317ec00d95754.dll
Size

413KB
MD5

151dd404afde20bb222e5aaf46fbb5f6
SHA1

27607d924f0da013cdab365978254a616c90b6f5
SHA256

655981dd3a088e17a81047b84a862ed6ef356c75829dfc221f4317ec00d95754
SHA512

a510c1486bdad0eb63bb5fda0ebecd1dce879b0e822cf556a832240cdfa4fabfb902ec5660292263becaf67ed258a8aed0598c0e3ecff8388165e621eef99e97
SSDEEP

3072:Gh+Q287Uss3Wf5eOZyut8rceDf07LqRlBnRqIso08KZsKKKBPSfYnaDx:Gh+Q287UvWBeDrDfqLqSDLkYaN

Score

8^/10

persistence

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2880	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\ÏµÍ³À¶ÆÁÐÞ¸´ = "C:\\Windows\\SysWOW64\\rundll32.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rifzsk = "C:\\Windows\\SysWOW64\\rundll32.exe"	rundll32.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2880	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2880	2332	rundll32.exe	28
PID 2332 wrote to memory of 2880	2332	rundll32.exe	28
PID 2332 wrote to memory of 2880	2332	rundll32.exe	28
PID 2332 wrote to memory of 2880	2332	rundll32.exe	28
PID 2332 wrote to memory of 2880	2332	rundll32.exe	28
PID 2332 wrote to memory of 2880	2332	rundll32.exe	28
PID 2332 wrote to memory of 2880	2332	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\655981dd3a088e17a81047b84a862ed6ef356c75829dfc221f4317ec00d95754.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\655981dd3a088e17a81047b84a862ed6ef356c75829dfc221f4317ec00d95754.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2880