e73ad94b595bdcd2a143c8dfaac2e83d3d88699a5631a540d35b0a5e99d4bf95

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

710ded986f079f05fe7d5b55f0bdcdf3.dll
Size

72KB
MD5

710ded986f079f05fe7d5b55f0bdcdf3
SHA1

d56b8f5c9a6d0a07e75821bcfe594ed6ab675089
SHA256

e73ad94b595bdcd2a143c8dfaac2e83d3d88699a5631a540d35b0a5e99d4bf95
SHA512

7a48c98be5f8f292c574a199bb44af081d3f49c0dfc4a53d82fd2165898d0d57043b05ca3387e1dc48e85879992db54a6f01468abba5651968c36aa1b905fa53
SSDEEP

1536:7vougPePCs9srnTqpHj3SDyRHkelNMDNR1Z:7wLPeKsOvD0PlNE

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lajooeii.dll	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 1108	3644	rundll32.exe	14
PID 3644 wrote to memory of 1108	3644	rundll32.exe	14
PID 3644 wrote to memory of 1108	3644	rundll32.exe	14

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\710ded986f079f05fe7d5b55f0bdcdf3.dll,#1
1⤵
- Drops file in System32 directory
PID:1108

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\710ded986f079f05fe7d5b55f0bdcdf3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads