5d2d957299e0b7b24198393dfb954fd03822dcf46874abcc5054d971ab446b81

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 02:02

Target

$TEMP/kR9R5GkiZB.dll
Size

67KB
MD5

0926c75dcfb71173c22ed89e44ea6f78
SHA1

012ecac790739f5b92f207ff9f1cbb4dc86516e3
SHA256

40055fa711c4e132099cc760c6b8f10423233b6543be153d7e895a5af1070d55
SHA512

4f761af8f8bec360ae3842d57f12648f6cfca1355954e55b882b983022849b8004dfca61015a913ccf2f0f0e93b6dd853d4710c7d5bdbf738a7c3a12f1ba3608
SSDEEP

1536:w3A1mzmabNdopbmBQdTP66LNMGF51Bct4EB7:BIopjTP6+NxC

Score

1^/10

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4108	PING.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 2552	4728	rundll32.exe	15
PID 4728 wrote to memory of 2552	4728	rundll32.exe	15
PID 4728 wrote to memory of 2552	4728	rundll32.exe	15
PID 2552 wrote to memory of 2980	2552	rundll32.exe	26
PID 2552 wrote to memory of 2980	2552	rundll32.exe	26
PID 2552 wrote to memory of 2980	2552	rundll32.exe	26
PID 2980 wrote to memory of 4108	2980	cmd.exe	28
PID 2980 wrote to memory of 4108	2980	cmd.exe	28
PID 2980 wrote to memory of 4108	2980	cmd.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\kR9R5GkiZB.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\kR9R5GkiZB.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /e:on /d /c ping -n 6 127.0.0.1 && DEL /F "C:\Users\Admin\AppData\Local\Temp\$TEMP\kR9R5GkiZB.dll" >> nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 6 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4108

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact