Analysis
-
max time kernel
49s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
20/10/2022, 16:41
General
-
Target
015b9249fbeb76f3a6eeac4964cc1a1bda3632acc84f3d450bc465383fe3e106.dll
-
Size
9KB
-
MD5
a097dd4743366301af73432fcad7dcd0
-
SHA1
b469a41cc5ab4022ab878d2314a56977053714eb
-
SHA256
015b9249fbeb76f3a6eeac4964cc1a1bda3632acc84f3d450bc465383fe3e106
-
SHA512
a8d12e367dfc10ba8eb341e150da996b54cd5fe919ba7c86702f073f5d988355d5b331b680541a6a46dc3208ca1cf45e3f2f2c4f4b9e1efcdc66208563edd3ef
-
SSDEEP
96:xIYeyAJRjzeDrTd0s1MjsuTSFT949h9oS+BfObKSczxn:Uyoxe7d0KMjRWFZTObKSczx
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\015b9249fbeb76f3a6eeac4964cc1a1bda3632acc84f3d450bc465383fe3e106.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\015b9249fbeb76f3a6eeac4964cc1a1bda3632acc84f3d450bc465383fe3e106.dll,#13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-