34e1162151589c11d175412c8d84666b781a66f4b9690b71574348824df5a18b

Analysis

max time kernel
138s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 03:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

57cf9f8f973ff9ef8b722b45b8c60db2.exe
Size

76KB
MD5

57cf9f8f973ff9ef8b722b45b8c60db2
SHA1

0dd593a2bcd25127ed3600ab3b8bf5d2aa36b971
SHA256

34e1162151589c11d175412c8d84666b781a66f4b9690b71574348824df5a18b
SHA512

44a089f2c5a59774306415ba8db98669c00dd777a54ea0a94053d0b32326f221e6a65bea53b5c78400e0e8477c30fe382256d4e6c3901e750284f2f55e2f282c
SSDEEP

1536:IZTRuvQhDQnx15j6x+MTVqc+8f/NntAcqRSEaWEBL/:IRYvQhkv5VMTVq78NntLEaWEZ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2732	DllServ.exe
2924	DllServ.exe
564	DllServ.exe
1128	DllServ.exe
2060	DllServ.exe
1916	DllServ.exe
2912	DllServ.exe
1588	DllServ.exe
2372	DllServ.exe
1928	DllServ.exe

Loads dropped DLL 20 IoCs

pid	Process
2360	57cf9f8f973ff9ef8b722b45b8c60db2.exe
2360	57cf9f8f973ff9ef8b722b45b8c60db2.exe
2732	DllServ.exe
2732	DllServ.exe
2924	DllServ.exe
2924	DllServ.exe
564	DllServ.exe
564	DllServ.exe
1128	DllServ.exe
1128	DllServ.exe
2060	DllServ.exe
2060	DllServ.exe
1916	DllServ.exe
1916	DllServ.exe
2912	DllServ.exe
2912	DllServ.exe
1588	DllServ.exe
1588	DllServ.exe
2372	DllServ.exe
2372	DllServ.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File created	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File created	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File created	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File created	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	57cf9f8f973ff9ef8b722b45b8c60db2.exe
File created	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File created	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File created	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File created	C:\Windows\SysWOW64\DllServ.exe	57cf9f8f973ff9ef8b722b45b8c60db2.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File created	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File opened for modification	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe
File created	C:\Windows\SysWOW64\DllServ.exe	DllServ.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2732	2360	57cf9f8f973ff9ef8b722b45b8c60db2.exe	28
PID 2360 wrote to memory of 2732	2360	57cf9f8f973ff9ef8b722b45b8c60db2.exe	28
PID 2360 wrote to memory of 2732	2360	57cf9f8f973ff9ef8b722b45b8c60db2.exe	28
PID 2360 wrote to memory of 2732	2360	57cf9f8f973ff9ef8b722b45b8c60db2.exe	28
PID 2732 wrote to memory of 2924	2732	DllServ.exe	29
PID 2732 wrote to memory of 2924	2732	DllServ.exe	29
PID 2732 wrote to memory of 2924	2732	DllServ.exe	29
PID 2732 wrote to memory of 2924	2732	DllServ.exe	29
PID 2924 wrote to memory of 564	2924	DllServ.exe	32
PID 2924 wrote to memory of 564	2924	DllServ.exe	32
PID 2924 wrote to memory of 564	2924	DllServ.exe	32
PID 2924 wrote to memory of 564	2924	DllServ.exe	32
PID 564 wrote to memory of 1128	564	DllServ.exe	33
PID 564 wrote to memory of 1128	564	DllServ.exe	33
PID 564 wrote to memory of 1128	564	DllServ.exe	33
PID 564 wrote to memory of 1128	564	DllServ.exe	33
PID 1128 wrote to memory of 2060	1128	DllServ.exe	34
PID 1128 wrote to memory of 2060	1128	DllServ.exe	34
PID 1128 wrote to memory of 2060	1128	DllServ.exe	34
PID 1128 wrote to memory of 2060	1128	DllServ.exe	34
PID 2060 wrote to memory of 1916	2060	DllServ.exe	35
PID 2060 wrote to memory of 1916	2060	DllServ.exe	35
PID 2060 wrote to memory of 1916	2060	DllServ.exe	35
PID 2060 wrote to memory of 1916	2060	DllServ.exe	35
PID 1916 wrote to memory of 2912	1916	DllServ.exe	36
PID 1916 wrote to memory of 2912	1916	DllServ.exe	36
PID 1916 wrote to memory of 2912	1916	DllServ.exe	36
PID 1916 wrote to memory of 2912	1916	DllServ.exe	36
PID 2912 wrote to memory of 1588	2912	DllServ.exe	37
PID 2912 wrote to memory of 1588	2912	DllServ.exe	37
PID 2912 wrote to memory of 1588	2912	DllServ.exe	37
PID 2912 wrote to memory of 1588	2912	DllServ.exe	37
PID 1588 wrote to memory of 2372	1588	DllServ.exe	38
PID 1588 wrote to memory of 2372	1588	DllServ.exe	38
PID 1588 wrote to memory of 2372	1588	DllServ.exe	38
PID 1588 wrote to memory of 2372	1588	DllServ.exe	38
PID 2372 wrote to memory of 1928	2372	DllServ.exe	39
PID 2372 wrote to memory of 1928	2372	DllServ.exe	39
PID 2372 wrote to memory of 1928	2372	DllServ.exe	39
PID 2372 wrote to memory of 1928	2372	DllServ.exe	39

C:\Users\Admin\AppData\Local\Temp\57cf9f8f973ff9ef8b722b45b8c60db2.exe
"C:\Users\Admin\AppData\Local\Temp\57cf9f8f973ff9ef8b722b45b8c60db2.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\DllServ.exe
  C:\Windows\system32\DllServ.exe 540 "C:\Users\Admin\AppData\Local\Temp\57cf9f8f973ff9ef8b722b45b8c60db2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\DllServ.exe
    C:\Windows\system32\DllServ.exe 524 "C:\Windows\SysWOW64\DllServ.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\DllServ.exe
      C:\Windows\system32\DllServ.exe 528 "C:\Windows\SysWOW64\DllServ.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Windows\SysWOW64\DllServ.exe
        
        C:\Windows\system32\DllServ.exe 532 "C:\Windows\SysWOW64\DllServ.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1128
      - C:\Windows\SysWOW64\DllServ.exe
        
        C:\Windows\system32\DllServ.exe 516 "C:\Windows\SysWOW64\DllServ.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\SysWOW64\DllServ.exe
        
        C:\Windows\system32\DllServ.exe 544 "C:\Windows\SysWOW64\DllServ.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\DllServ.exe
        
        C:\Windows\system32\DllServ.exe 548 "C:\Windows\SysWOW64\DllServ.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\DllServ.exe
        
        C:\Windows\system32\DllServ.exe 552 "C:\Windows\SysWOW64\DllServ.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\DllServ.exe
        
        C:\Windows\system32\DllServ.exe 560 "C:\Windows\SysWOW64\DllServ.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\DllServ.exe
        
        C:\Windows\system32\DllServ.exe 564 "C:\Windows\SysWOW64\DllServ.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\DllServ.exe

Filesize
76KB

MD5
57cf9f8f973ff9ef8b722b45b8c60db2

SHA1
0dd593a2bcd25127ed3600ab3b8bf5d2aa36b971

SHA256
34e1162151589c11d175412c8d84666b781a66f4b9690b71574348824df5a18b

SHA512
44a089f2c5a59774306415ba8db98669c00dd777a54ea0a94053d0b32326f221e6a65bea53b5c78400e0e8477c30fe382256d4e6c3901e750284f2f55e2f282c

Download Submit
memory/564-29-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/564-23-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1128-28-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1128-35-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1128-32-0x00000000027B0000-0x0000000002829000-memory.dmp

Filesize
484KB

Download
memory/1588-52-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1588-47-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1916-43-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1928-56-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2060-34-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2060-39-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2360-14-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2360-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2360-11-0x0000000002580000-0x00000000025F9000-memory.dmp

Filesize
484KB

Download
memory/2372-57-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2732-19-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2732-12-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2912-48-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2924-24-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2924-18-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads