Analysis

  • max time kernel
    153s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2023 12:20

General

  • Target

    184f4dd3d468162d4fca91bcb6e805c8.dll

  • Size

    113KB

  • MD5

    184f4dd3d468162d4fca91bcb6e805c8

  • SHA1

    8531ea461ce8a497d363a6b92801ba4726c20b48

  • SHA256

    cced96207df74e809d39be359b074b400a2b88f1e53f06a12a7e4c1b2d258fa3

  • SHA512

    68172d132a8c75ad7387e7d95875361a30dadeff7279212c679cae4dbcad3340790e2856999df1938cfddedb4fbfe4ebec6e6edeafc5d7c0f590da8bd879a277

  • SSDEEP

    3072:SZin1nqgKBwKGRkEsm2d+J6KzEl+KD/y4B+Zd1CzUJobfl8kB5mHOL:kiLKNGKEKdaSTz+ZdwzHbuH

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\184f4dd3d468162d4fca91bcb6e805c8.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\184f4dd3d468162d4fca91bcb6e805c8.dll,#1
      2⤵
      • Modifies WinLogon for persistence
      • Suspicious behavior: EnumeratesProcesses
      PID:4432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4432-0-0x00000000006A0000-0x00000000006C0000-memory.dmp

    Filesize

    128KB

  • memory/4432-1-0x00000000006A0000-0x00000000006C0000-memory.dmp

    Filesize

    128KB