c6fc14f95e87659fc31d96ea8660d237c80bc31daefc6bb4c08cb7f7d8383082

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 09:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b85bb3699de180ca3f4da3002fec92f6.dll
Size

412KB
MD5

b85bb3699de180ca3f4da3002fec92f6
SHA1

0274b5488ddade07fd03787de225805715671525
SHA256

c6fc14f95e87659fc31d96ea8660d237c80bc31daefc6bb4c08cb7f7d8383082
SHA512

3bade1e4f3be467ed5e17e07eca46c0914b24d2f468d2ae2732b7607e2a0a5d378ed6dfb11e7de0bfdc0beb4141b1e5cdb211ebd118b5540d7ad15e2ac078feb
SSDEEP

6144:wj44g1FPC0iApWfHoHPKkdM1Kb0jHoOhVaIYyHU/cYrbmLYHTInKOtGSVX:wE15CKUHoBN0zoO73Y7cYrbnHTIndPh

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\spool\PRTPROCS\x64\46B6.tmp	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	rundll32.exe
1512	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 1512	4528	rundll32.exe	87
PID 4528 wrote to memory of 1512	4528	rundll32.exe	87
PID 4528 wrote to memory of 1512	4528	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b85bb3699de180ca3f4da3002fec92f6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b85bb3699de180ca3f4da3002fec92f6.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\spool\prtprocs\x64\46B6.tmp

Filesize
352KB

MD5
65ef9b94b346b26f0309837b823e99fb

SHA1
084bd77bd61ceda524fd44d5310a983465c42596

SHA256
caccd43b7b8ab72354579f706e601e0c77bf87c5e0d32e83fedc3c73f3a8dafb

SHA512
61a935eeec05a0dc54df8a18fd91406f052fd9bfcd094115a986b7a20294ac2180768a85a36b6c5f93249ab14a3ef5c8a69b81322e07b57b1e4cafdea111f3fa

Download Submit
memory/1512-11-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-10-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-3-0x0000000002BC0000-0x0000000002C2A000-memory.dmp

Filesize
424KB

Download
memory/1512-7-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-12-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-9-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-2-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-0-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-8-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-13-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-14-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-15-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-1-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-24-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-25-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download
memory/1512-26-0x0000000077590000-0x0000000077680000-memory.dmp

Filesize
960KB

Download