6c697b24b7ae1959ac0cb9fe2b64cbe53fc979662bbb5fba832ca80db50bebe8

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0253d04e8d2e0e37476ea6d906aa30e2.dll
Size

5KB
MD5

0253d04e8d2e0e37476ea6d906aa30e2
SHA1

c9fa3afaff47e70f8ffec2b55cb3829841a70990
SHA256

6c697b24b7ae1959ac0cb9fe2b64cbe53fc979662bbb5fba832ca80db50bebe8
SHA512

f930942e6691287db0ec5f3510c2028b052ca40b29451fb38e0e1a9e11f20ad52fda665db31ea924c510f2eb5b83d3bfc2eaf1c5c60bc7779afcd4b216e88ebf
SSDEEP

96:D/xIrg4bS/1JExzn5GUrVrrsyk46k9XKag8gLuHrV90kkTErjQ:D/ek4bS/1JEpn4K5rnXKaKKp9VnQ

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2416	2408	rundll32.exe	28
PID 2408 wrote to memory of 2416	2408	rundll32.exe	28
PID 2408 wrote to memory of 2416	2408	rundll32.exe	28
PID 2408 wrote to memory of 2416	2408	rundll32.exe	28
PID 2408 wrote to memory of 2416	2408	rundll32.exe	28
PID 2408 wrote to memory of 2416	2408	rundll32.exe	28
PID 2408 wrote to memory of 2416	2408	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0253d04e8d2e0e37476ea6d906aa30e2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0253d04e8d2e0e37476ea6d906aa30e2.dll,#1
  2⤵
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...