Analysis
-
max time kernel
0s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
-
submitted
05-07-2024 04:32
General
-
Target
newdcnyash/data/RarExt.dll
-
Size
544KB
-
MD5
1f3bb0f89e7cd67a76220ea2e3e7d8c6
-
SHA1
0286863ca947b00a4e3489f07e1cddf9faddb87a
-
SHA256
68ecb747f523d122c1c2094b3fb6035f7f76fbd948a97e3d42ee526824546fec
-
SHA512
a95611f7b4cc7a3e5b9412d0c7e16616039c7152102b35aa8f672f15d21ff2478486c7a411d25d8f8d7b713a9bbd50f2a68bd048a6296a72ed4404c6cbb468ff
-
SSDEEP
12288:6aw1L7U6Qu1rTGl74V7pt21DIwd2gOuy33SH9Bd3X3u1EZ:6aw1L7U6Qu1rTAEV7p1wd2ZuWA9Bd3XL
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\newdcnyash\data\RarExt.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\newdcnyash\data\RarExt.dll,#12⤵