2f66b87534d0e252da98f11e8a2b43879298f3d9eac0b8c84f382e5c24e2f7a4

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 03:07

Target
ImUtilsU.dll
Size 1.4MB
Sample240624-dmt21awblb
SHA256 914b1e53451b8be2c362d62514f28bdef46a133535d959b13f3f4bf3bc63df3a
MD5 a7eaba8bc12b2b7ec2a41a4d9e45008a
SHA1 6a96a18bb4f1cd6196517713ed634f37f6b0362b
SHA512 0ae7fbdb2677d92c62337aa17b60a4887240a4a426ba638c7633587f4582adbcda2bde5ec824aab1a3f69acf2b391118763842acfab856d3d9764850961a2ac8
SSDEEP 24576:2EQirQajY+S5eqyL9dj7GP4a6xKlnNYndIA1HVtFyC0Glqb6WUOQZljMFbDG0:fQj+S5epJl7+eenN5+HVDD0bUOQPUbDP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2828	2496	rundll32.exe	28
PID 2496 wrote to memory of 2828	2496	rundll32.exe	28
PID 2496 wrote to memory of 2828	2496	rundll32.exe	28
PID 2496 wrote to memory of 2828	2496	rundll32.exe	28
PID 2496 wrote to memory of 2828	2496	rundll32.exe	28
PID 2496 wrote to memory of 2828	2496	rundll32.exe	28
PID 2496 wrote to memory of 2828	2496	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImUtilsU.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ImUtilsU.dll,#1
  2⤵
  PID:2828

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact