Analysis

  • max time kernel
    423s
  • max time network
    439s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-es
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows
  • submitted
    22/01/2025, 15:18

General

  • Target

    syssh.uno.dll

  • Size

    24KB

  • MD5

    749c5a95f9fb9a96e7f6b7d3bce8c986

  • SHA1

    b6875c9d859f3dd324e3d1d0958ef2d304a932e2

  • SHA256

    e1c0ca1cb0223aed6572e54c51dbc561ee957833d4faa61cc56d19316fd04e8b

  • SHA512

    e40678b12e467a4b2794355ab837030e314aa434bd883e0f35f3085f86db7fb21bd90b9751ad91134e13e81e1cc3944b288ac549f7f02c06fb84ce3ea9f4575f

  • SSDEEP

    384:u9EeXirxVjDblFrO+JCMcE4Nw2cvwfo62OKbggV5ap/orCRL:OE5TjD+My72OKjUor+

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\syssh.uno.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\syssh.uno.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2068

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads