Analysis

  • max time kernel
    99s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2023, 15:29

General

  • Target

    0afc908947b7c32c1d4a07872aad9262b9036300fa4abb24fdf8a7a078ed907b.dll

  • Size

    4.4MB

  • MD5

    d15a462fdb0f73f021b7004f5bb06df1

  • SHA1

    d5257c88731b674bf1e3ba98afe5190c1d40e8e4

  • SHA256

    0afc908947b7c32c1d4a07872aad9262b9036300fa4abb24fdf8a7a078ed907b

  • SHA512

    eebd3df4ebe6fabb8442528e21207dad18d1e1aeb3031d6ce36ea1fd00bf19a7f508d5c8b1622a65ea09303e6cbb81d4412c36bbd0541950a5ec08c822571272

  • SSDEEP

    98304:YW161hoXD1G2s3wswZDD/OwjYuda7pZX4PAx+N:O1+XDIHwsKDD/Owi7n4PAx

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0afc908947b7c32c1d4a07872aad9262b9036300fa4abb24fdf8a7a078ed907b.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0afc908947b7c32c1d4a07872aad9262b9036300fa4abb24fdf8a7a078ed907b.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1000
      • C:\Users\Admin\AppData\Local\Temp\clink9650.exe
        clink9650.exe
        3⤵
        • Executes dropped EXE
        PID:4748

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\clink9650.exe

          Filesize

          4.2MB

          MD5

          83102ffc3c761fc70f003ebefa6cc529

          SHA1

          2d85a33a11ab12fe2be3945c897c11f072153e19

          SHA256

          d2f345626d48b0954880980e48bb23da1344a9e97a3f0fc101e80330ff8d22db

          SHA512

          7d0b6bb18bcf1afa3607b5eefe262e86af7336d27668917e1d3977645ac2819bcce20531634fa5c2ed8e4a0337d2d5410a4ac36f83f437d3449977f7dbe149d0