06ce4c1421bdccfe8d7246807747423da2b17d2812282c857c43d38aab7b2abd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/03/2024, 13:06

Target

b4c3c8d3e3e62218d157c2dbdd4ee7c2.dll
Size

64KB
MD5

b4c3c8d3e3e62218d157c2dbdd4ee7c2
SHA1

b523d334c109620c48f2f2df44cd322cb9ccde81
SHA256

06ce4c1421bdccfe8d7246807747423da2b17d2812282c857c43d38aab7b2abd
SHA512

86073070145d56880a2dd1501312cdbcee03c028a521c36be7f93d507c8c6a45e345c0937f1a64766df951d0e4244fecf4f3a18e24b869ed7c88c314b3b05657
SSDEEP

1536:WjXRlJTILsc9EL+appNcvETXtDifLzcC:AXR/ILsc9g+app6vETd+TX

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2304	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28
PID 2276 wrote to memory of 2304	2276	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c3c8d3e3e62218d157c2dbdd4ee7c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c3c8d3e3e62218d157c2dbdd4ee7c2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2304-0-0x0000000000170000-0x0000000000178000-memory.dmp

Filesize
32KB

Download
memory/2304-3-0x0000000000170000-0x0000000000178000-memory.dmp

Filesize
32KB

Download