78106893233229bebab927c6ecee0541226d914ad91575d6c9e2645407a8b2e1

Analysis

max time kernel
139s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 02:11

Target

78106893233229bebab927c6ecee0541226d914ad91575d6c9e2645407a8b2e1.dll
Size

7.4MB
MD5

ef553cda52bf2fe68a51c0869480d892
SHA1

cb3aa2500d7f02b5a72d10e05af865feb15abcf6
SHA256

78106893233229bebab927c6ecee0541226d914ad91575d6c9e2645407a8b2e1
SHA512

fbd7a18aa233164a01422426c39c86cb2b1f2af13c8c51e84e08dbcd9c6e4657f97ea82e402c4a00c4162f9bd3f943618fe4dbfda822ddd69679010d8a5d43e1
SSDEEP

196608:rwrx2zn+uJnO/RZ02eQUmP76BTjpKPrKR2NzpLfaP+e3e7TeKikBWS0NoEhKt4WI:rwrYn+uJnO/302eQTOBTjpKPrK2NzpLE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2404	rundll32.exe
2404	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78106893233229bebab927c6ecee0541226d914ad91575d6c9e2645407a8b2e1.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2404

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact