Analysis
-
max time kernel
209s -
max time network
277s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
-
submitted
16/11/2024, 13:28 UTC
General
-
Target
Plugins/Recovery.dll
-
Size
309KB
-
MD5
08131d6801c109f0764a4fe690aba8ef
-
SHA1
e732af02326483700eda52ff40dc70cff6b7afcb
-
SHA256
bc3a9390c043f8002e356ad34b2b11d3486682d0c275ab6729bb4a312e324f51
-
SHA512
228ab0aa0ddfdb0c099f1db5112304d776cb97ab2dab376d38023e446cb2aec30d9585eba444818f3241ffbc28565a1aef11f97b5b42bf57037de8e4a8536e2a
-
SSDEEP
6144:sb8xPy7+NKMDMAlcn38OxKl9x7qs9Pxcm0AUNy9rsxLaxHUX:sbBMDMVqfBdcmDBuX
Score
1/10
Malware Config
Signatures
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Plugins\Recovery.dll,#11⤵
Network
-
DNS23.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request23.236.111.52.in-addr.arpaIN PTRResponse -
DNS226.162.46.104.in-addr.arpaRemote address:8.8.8.8:53Request226.162.46.104.in-addr.arpaIN PTRResponse
-
DNSocsp.digicert.comRemote address:8.8.8.8:53Requestocsp.digicert.comIN AResponseocsp.digicert.comIN CNAMEocsp.edge.digicert.comocsp.edge.digicert.comIN CNAMEfp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.2be4.phicdn.netIN CNAMEfp2e7a.wpc.phicdn.netfp2e7a.wpc.phicdn.netIN A192.229.221.95
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEbg.microsoft.map.fastly.netbg.microsoft.map.fastly.netIN A199.232.214.172bg.microsoft.map.fastly.netIN A199.232.210.172
No results found
-
8.8.8.8:5323.236.111.52.in-addr.arpadns
DNS Request
23.236.111.52.in-addr.arpa
DNS Request
226.162.46.104.in-addr.arpa
DNS Request
ocsp.digicert.com
DNS Response
192.229.221.95
DNS Request
ctldl.windowsupdate.com
DNS Response
199.232.214.172199.232.210.172