a9f96a18004e5636c86b6492347ab57ea82f02ffbb31b4053fc49136a3026ce5

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 01:57

Target

5fb00fcc717dee09a19cf0ad86fa0bc2c8c0cdb4a33643bba4856f2e5d3fbd18.dll
Size

108KB
MD5

22550198c3cf0137adab338814227034
SHA1

44f094f6e7e45e9a8ee6f9b50b4eff45b0da9643
SHA256

5fb00fcc717dee09a19cf0ad86fa0bc2c8c0cdb4a33643bba4856f2e5d3fbd18
SHA512

38e853229ab7ca32c421d278a714415a61c403856df71197857088a918e1468b37844603578ba8ecb87ccfff1a6fbbfc9eb7ca1ab1631f828840fa2b4c40f7b3
SSDEEP

1536:Z0phaPh6KMG2KCB+Cyn1mz2FrTG8+2olmnlguqiPltGcWAKt3sd2NX:CzvU11OkJ1XWAKt3sgN

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1928 rundll32.exe
1928 rundll32.exe

pid	process
1928	rundll32.exe
1928	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1748 wrote to memory of 1928	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1928	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1928	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1928	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1928	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1928	1748	rundll32.exe	rundll32.exe
PID 1748 wrote to memory of 1928	1748	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fb00fcc717dee09a19cf0ad86fa0bc2c8c0cdb4a33643bba4856f2e5d3fbd18.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5fb00fcc717dee09a19cf0ad86fa0bc2c8c0cdb4a33643bba4856f2e5d3fbd18.dll,#1
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance