a862a910e7db2cc770af1e0280cabb6ce5f70df93f55ea9c774b6de9e48259d6 | Triage

Analysis

max time kernel
87s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2023 23:48

Sharing

Report Analysis Logs

General

Target

077f61ac0d6a193429c6a3bff9b07472.dll
Size

14KB
MD5

077f61ac0d6a193429c6a3bff9b07472
SHA1

39dc7e49b6da9f38e77e4fb3d3b4c783cb98b227
SHA256

a862a910e7db2cc770af1e0280cabb6ce5f70df93f55ea9c774b6de9e48259d6
SHA512

c05ebd61e0ded7d42d21bf2a1a43a9e78ecc4665eba2a050172fd573fe0e22a107f33329b0087626114a98292ae796ff0163965c2fcf7ab36c2680fb7aeaabe8
SSDEEP

384:KlpnmJJk7dYeiiBfI8Ux+sZFnBrjdS3KkHl1:K3mriTvUds3KkHX

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1608	rundll32.exe
1608	rundll32.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 1608	1176	rundll32.exe	88
PID 1176 wrote to memory of 1608	1176	rundll32.exe	88
PID 1176 wrote to memory of 1608	1176	rundll32.exe	88
PID 1608 wrote to memory of 2768	1608	rundll32.exe	71
PID 1608 wrote to memory of 2844	1608	rundll32.exe	69
PID 1608 wrote to memory of 2396	1608	rundll32.exe	68
PID 1608 wrote to memory of 3436	1608	rundll32.exe	63
PID 1608 wrote to memory of 3576	1608	rundll32.exe	62
PID 1608 wrote to memory of 3744	1608	rundll32.exe	61
PID 1608 wrote to memory of 3860	1608	rundll32.exe	60
PID 1608 wrote to memory of 3948	1608	rundll32.exe	34
PID 1608 wrote to memory of 4056	1608	rundll32.exe	59
PID 1608 wrote to memory of 4196	1608	rundll32.exe	58
PID 1608 wrote to memory of 4504	1608	rundll32.exe	56
PID 1608 wrote to memory of 4772	1608	rundll32.exe	47
PID 1608 wrote to memory of 1012	1608	rundll32.exe	39
PID 1608 wrote to memory of 2256	1608	rundll32.exe	38
PID 1608 wrote to memory of 4248	1608	rundll32.exe	36
PID 1608 wrote to memory of 1176	1608	rundll32.exe	37

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3948

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4248

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\077f61ac0d6a193429c6a3bff9b07472.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\077f61ac0d6a193429c6a3bff9b07472.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1608

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2256

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:1012

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4772

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4504

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4196

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4056

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3860

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3576

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2844

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-0-0x0000000000B90000-0x0000000000B9F000-memory.dmp

Filesize
60KB

Download
memory/1608-1-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

Filesize
40KB

Download
memory/1608-2-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/1608-4-0x0000000000B90000-0x0000000000B9F000-memory.dmp

Filesize
60KB

Download