46bfa6676bf1b00408f4067c58be19441a50b817a5240a3f97da52bd5bd8f2b6

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 08:13

Target

8ea6c73e0ba18a41301c2d2e7fc7ec4a.dll
Size

63KB
MD5

8ea6c73e0ba18a41301c2d2e7fc7ec4a
SHA1

2e25344a2b762df313b95500e36c746c2d6e9773
SHA256

46bfa6676bf1b00408f4067c58be19441a50b817a5240a3f97da52bd5bd8f2b6
SHA512

8a4831d35b3a0d2ff42b32c1cc3b517685b2c1cff2f8bfa2bfeeec06cf8635bb18901a5c4c8e8dd94bebe66f15d8f8da4da3e9f75306043d54620bced16aa5ab
SSDEEP

1536:iTaPjYhMPWIUTHIdlpvSm90ZqSSdsKRBcAvw+ItM:nPjdvUTyl5SQfdePT+It

Score

7^/10

spyware stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1220	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1220	2180	rundll32.exe	28
PID 2180 wrote to memory of 1220	2180	rundll32.exe	28
PID 2180 wrote to memory of 1220	2180	rundll32.exe	28
PID 2180 wrote to memory of 1220	2180	rundll32.exe	28
PID 2180 wrote to memory of 1220	2180	rundll32.exe	28
PID 2180 wrote to memory of 1220	2180	rundll32.exe	28
PID 2180 wrote to memory of 1220	2180	rundll32.exe	28
PID 1220 wrote to memory of 1260	1220	rundll32.exe	18

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1220-0-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1260-1-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download