Overview
overview
10Static
static
10TotalAV.exe
windows7-x64
7TotalAV.exe
windows10-2004-x64
7Utilizr.dll
windows7-x64
1Utilizr.dll
windows10-2004-x64
1WinRT.Runtime.dll
windows7-x64
1WinRT.Runtime.dll
windows10-2004-x64
1WindowsBase.dll
windows7-x64
1WindowsBase.dll
windows10-2004-x64
1WindowsFor...on.dll
windows7-x64
1WindowsFor...on.dll
windows10-2004-x64
1aspnetcore...ss.dll
windows7-x64
3aspnetcore...ss.dll
windows10-2004-x64
3bins/subinacl.exe
windows7-x64
1bins/subinacl.exe
windows10-2004-x64
1clretwrc.dll
windows7-x64
1clretwrc.dll
windows10-2004-x64
1clrgc.dll
windows7-x64
3clrgc.dll
windows10-2004-x64
3clrjit.dll
windows7-x64
1clrjit.dll
windows10-2004-x64
1coreclr.dll
windows7-x64
1coreclr.dll
windows10-2004-x64
1createdump.exe
windows7-x64
1createdump.exe
windows10-2004-x64
1e_sqlite3.dll
windows7-x64
3e_sqlite3.dll
windows10-2004-x64
3grpc_cshar...86.dll
windows7-x64
3grpc_cshar...86.dll
windows10-2004-x64
3hostfxr.dll
windows7-x64
1hostfxr.dll
windows10-2004-x64
3hostpolicy.dll
windows7-x64
1hostpolicy.dll
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 11:53
Behavioral task
behavioral1
Sample
TotalAV.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TotalAV.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Utilizr.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Utilizr.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
WinRT.Runtime.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
WinRT.Runtime.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
WindowsBase.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
WindowsBase.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
WindowsFormsIntegration.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
WindowsFormsIntegration.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
aspnetcorev2_inprocess.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
aspnetcorev2_inprocess.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
bins/subinacl.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
bins/subinacl.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
clretwrc.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
clretwrc.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
clrgc.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
clrgc.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
clrjit.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
clrjit.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
coreclr.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
coreclr.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
createdump.exe
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
createdump.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
e_sqlite3.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
e_sqlite3.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
grpc_csharp_ext.x86.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
grpc_csharp_ext.x86.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
hostfxr.dll
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
hostfxr.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
hostpolicy.dll
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
hostpolicy.dll
Resource
win10v2004-20240226-en
General
-
Target
WindowsFormsIntegration.dll
-
Size
190KB
-
MD5
087d917310a9355ef8ed1f55104872e9
-
SHA1
7a681602ec4d82f3659b750670f18aad3778d4e1
-
SHA256
5f14056bf15c6f4bce946d95289ad5659bb5a7f2756b0da3dc22799eccfcf2a2
-
SHA512
270f970fdf090173650a8b2667aeee6823609993398d352ecf3d28350a2427125f657ac9f5a1f60355bdcc8bebfa75500c97a88b851508f327df3530b34c5ae4
-
SSDEEP
3072:E9l1w2q3QtH5W6pyJ4GJxWjQ/pIUGOpQBdxeVJm49mwCl5qf0B9iK8aJkmsWmuUL:teZWRJxWjSpGO6wPeZUvuCF
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4844 wrote to memory of 848 4844 rundll32.exe 86 PID 4844 wrote to memory of 848 4844 rundll32.exe 86 PID 4844 wrote to memory of 848 4844 rundll32.exe 86