34e8478a258b1b17644bdb5b81de8f805224db14ffeee9d33614e567046be3b7

General

Target

34e8478a258b1b17644bdb5b81de8f805224db14ffeee9d33614e567046be3b7.dll
Size

35KB
MD5

5fe2dcee2f2a7614b0afa4915533b16c
SHA1

c4e51b76564cb405b031c8e5041e90ab4c4ebd76
SHA256

34e8478a258b1b17644bdb5b81de8f805224db14ffeee9d33614e567046be3b7
SHA512

3222d1761999c924cf11ef45e009c03f028441ec30f99da490ca0d7e4a6ab11fdb5038457642101cfe8fa0559179213effeca09c619b1210803a8451860b5bd7

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

336 svchost.exe

pid	process
336	svchost.exe

Drops file in System32 directory 2 IoCs

Processes:

rundll32.exesvchost.exe

description	ioc	process
File created	C:\Windows\system32\vBszKyhVp.dll	rundll32.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

3904 rundll32.exe
3904 rundll32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 3904 rundll32.exe
Suspicious use of WriteProcessMemory 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 3904 wrote to memory of 336 3904 rundll32.exe svchost.exe

pid	process
3904	rundll32.exe
3904	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	3904	rundll32.exe

description	pid	process	target process
PID 3904 wrote to memory of 336	3904	rundll32.exe	svchost.exe

C:\Windows\system32\vBszKyhVp.dll
MD5
22a9e1060c45f2d0919e22c1030183d1

SHA1
62a53ff68d1c862c9c68fb577b06fa261ef573e4

SHA256
7a48dd8cc1c52caaf6abf8ea15fda2a91244751919e106c7510829f2999f727e

SHA512
b7624adc49e7b393407ba3d4cea8162aeb2074862b85497628dbb67c0589607c33f529b069ffd3d69e10d1b79167423bc782645a228025ab1aac1c645e651ac1

Download Submit
\Windows\System32\vBszKyhVp.dll
MD5
22a9e1060c45f2d0919e22c1030183d1

SHA1
62a53ff68d1c862c9c68fb577b06fa261ef573e4

SHA256
7a48dd8cc1c52caaf6abf8ea15fda2a91244751919e106c7510829f2999f727e

SHA512
b7624adc49e7b393407ba3d4cea8162aeb2074862b85497628dbb67c0589607c33f529b069ffd3d69e10d1b79167423bc782645a228025ab1aac1c645e651ac1

Download Submit