d4b97b1e59e99235af7aae89b12d3c20d7648f22b4ba924eedbbbdbc7c0d9405

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5823a8ae676989d3f2710c9e8548007f.dll
Size

98KB
MD5

5823a8ae676989d3f2710c9e8548007f
SHA1

e726d0970b57de22a0f4b717dd2ad77ffa296e30
SHA256

d4b97b1e59e99235af7aae89b12d3c20d7648f22b4ba924eedbbbdbc7c0d9405
SHA512

05a1d6af5b9e2c4976ada7c5bb15e515190e85c628d314eaadd77b3de4c0b324d20c40fc1be2a3f995f6e60ae974d620552fa9d1ce32bbb80201de45fe48ce3b
SSDEEP

1536:SgfLUDtzkT1Lk6JF5g2rHGHfqKfq/oieDnLQdKfDwMrU1ms46KWUiG4:SgAug2rQWerL7ns49WUiF

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1468	netsh.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 824 wrote to memory of 912	824	rundll32.exe	28
PID 912 wrote to memory of 1468	912	rundll32.exe	29
PID 912 wrote to memory of 1468	912	rundll32.exe	29
PID 912 wrote to memory of 1468	912	rundll32.exe	29
PID 912 wrote to memory of 1468	912	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5823a8ae676989d3f2710c9e8548007f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5823a8ae676989d3f2710c9e8548007f.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set allowedprogram "%systemroot%\system32\scvhost.exe" enable
    3⤵
    - Modifies Windows Firewall
    PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads