Analysis
-
max time kernel
0s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 20:13
Static task
static1
Behavioral task
behavioral1
Sample
4c5b37b5872500caaa1034d761f99d06.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4c5b37b5872500caaa1034d761f99d06.dll
Resource
win10v2004-20231215-en
General
-
Target
4c5b37b5872500caaa1034d761f99d06.dll
-
Size
526KB
-
MD5
4c5b37b5872500caaa1034d761f99d06
-
SHA1
b3f85353c60e476b87b06b9d9637a749798deb3b
-
SHA256
b9a859377b83e2a0cb734ed8898905dd4cf855e4d38e1b917d1542212d93835a
-
SHA512
9667842ddb110f4070fbad772d42b9604e9ec7b457860c5bfbc4192a925417f432897f01c21915ccc7873690f7e0c53b5f15b863ca82aaa0c7ebf437b7544100
-
SSDEEP
384:niNjtU2O/V/Z/bSzkBUNW5D11vcW7FAAB5ymzvbMkZi/Zm7:niKb2ABUNWyW7FAAB5yWvbMkQA
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\verclsid.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1752 1688 rundll32.exe 18 PID 1688 wrote to memory of 1752 1688 rundll32.exe 18 PID 1688 wrote to memory of 1752 1688 rundll32.exe 18 PID 1688 wrote to memory of 1752 1688 rundll32.exe 18 PID 1688 wrote to memory of 1752 1688 rundll32.exe 18 PID 1688 wrote to memory of 1752 1688 rundll32.exe 18 PID 1688 wrote to memory of 1752 1688 rundll32.exe 18 PID 1752 wrote to memory of 2284 1752 rundll32.exe 16 PID 1752 wrote to memory of 2284 1752 rundll32.exe 16 PID 1752 wrote to memory of 2284 1752 rundll32.exe 16 PID 1752 wrote to memory of 2284 1752 rundll32.exe 16
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4c5b37b5872500caaa1034d761f99d06.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4c5b37b5872500caaa1034d761f99d06.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1752
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\~DFD259393735.bat1⤵PID:2284
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121B
MD509517fc62284f33e877a276463580bd1
SHA10b14fe1db4493818f9de0bf2a56ee5370b8d479a
SHA2566cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238
SHA5121b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d