Analysis
- max time kernel
148s - max time network
137s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/01/2022, 09:48
Static task
static1
Behavioral task
behavioral1
Sample
wuaueng.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
wuaueng.dll
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target wuaueng.dll
- Size 227KB
- Sample220128-lssecsafgp
- SHA256 829eceee720b0a3e505efbd3262c387b92abdf46183d51a50489e2b157dac3b1
- MD5 490c885dc7ba0f32c07ddfe02a04bbb9
- SHA1 294690c1aee8dc7723858dafcb2a0ed273296641
- SHA512 127f014d18b926433d56bfee85b350fe36cc26a1442ef8f16cf1c9e6cce95c2f83a8609b9d29e53b7b5617739f760ba4263bd6222870fd25309a16d46000d29c
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 912 rundll32.exe 912 rundll32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3056 Explorer.EXE - Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE Token: SeShutdownPrivilege 3056 Explorer.EXE Token: SeCreatePagefilePrivilege 3056 Explorer.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 912 wrote to memory of 3056 912 rundll32.exe 20 PID 912 wrote to memory of 3056 912 rundll32.exe 20 PID 912 wrote to memory of 3056 912 rundll32.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3056 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\wuaueng.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:912
-