f024a0118a4207c894718b8660e6939aa6c56da5385e51a5a521c8b5214df9a4

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3bb348d0127d5d8c4a3dacb91cc73259.dll
Size

11KB
MD5

3bb348d0127d5d8c4a3dacb91cc73259
SHA1

6e9047073d5afe1ccc1cd03f7f95e45b50e09375
SHA256

f024a0118a4207c894718b8660e6939aa6c56da5385e51a5a521c8b5214df9a4
SHA512

3d04b76b1e222d427578fc764e965c1c43803158edaabc34dbd2924a30997727407250e1646c968489a7abd9f4a1247135a49243c092bae23257de9048a38751
SSDEEP

192:hIdrwL9k5Yig6eha+ikhxVmtA62IR4aQiEyUf6pYMOXS:hIpR5Yig6ehawxVmtr2Q4aQiEPChOXS

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Sysmppcv = "rundll32.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\3bb348d0127d5d8c4a3dacb91cc73259.dll,#1"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28
PID 3028 wrote to memory of 1756	3028	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bb348d0127d5d8c4a3dacb91cc73259.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3bb348d0127d5d8c4a3dacb91cc73259.dll,#1
  2⤵
  - Adds Run key to start application
  PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads