Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2024, 21:59

General

  • Target

    b33446ab217e39a2c54302f5aac1cc50.dll

  • Size

    68KB

  • MD5

    b33446ab217e39a2c54302f5aac1cc50

  • SHA1

    7542fba7a8e516f595b6758b87b9c7ca49f333d8

  • SHA256

    d87dab6eafabb7ebdf23ef31ebb07be6769c1d052f97f09afaefce5792fd8a38

  • SHA512

    e535f9831315d5ea3b09951f6f7a30ca142cc69e0b5188688edbe84d4fc619229bb548536ec384b19f90a6c338eef80081ff71b9965185d3182eb4d4d584024f

  • SSDEEP

    1536:9cmgeI6A8fk1l4D1aDG/8aP5rY2H8uI0WvU17iX14VzVzQ425MZ:9cm7IF8fKHD88aP5xH8XvU7iWVBcBa

Score
6/10

Malware Config

Signatures

  • Modifies WinLogon 2 TTPs 7 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b33446ab217e39a2c54302f5aac1cc50.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b33446ab217e39a2c54302f5aac1cc50.dll,#1
      2⤵
      • Modifies WinLogon
      • Drops file in System32 directory
      PID:3760

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads