f9113b6cf705d399ab6f394d7df4b26301909f48f2230b93cc7c9a0dae0600e2

Analysis

max time kernel
92s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4d69acc82de86db59ff733d7c4504240b8bc8988e3d8593ce674415f0db74b7.dll
Size

108KB
MD5

8893047b15405b20a39afbb8f9cc4d1e
SHA1

6c84262903cadb218bfc16e1784af86ed32ff9bd
SHA256

f4d69acc82de86db59ff733d7c4504240b8bc8988e3d8593ce674415f0db74b7
SHA512

949ebf6d501d7dc5214ff838498c146c97f3160c9097846f2706904ec00b7ebbaadae9356c2a520d082f00b04c96fe6235d189eb0cac59e4b639426b7e8d2d50
SSDEEP

1536:o0phaPh6KMG2KCB+Cjn1mz2FrTG8+2olmnlguqiPltGcWAKtQs3NX:lzvl11OkJ1XWAKtQs3N

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	rundll32.exe
1736	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 1736	440	rundll32.exe	80
PID 440 wrote to memory of 1736	440	rundll32.exe	80
PID 440 wrote to memory of 1736	440	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4d69acc82de86db59ff733d7c4504240b8bc8988e3d8593ce674415f0db74b7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4d69acc82de86db59ff733d7c4504240b8bc8988e3d8593ce674415f0db74b7.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...