Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 10:54
Static task
static1
Behavioral task
behavioral1
Sample
0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867.dll
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867.dll
-
Size
740KB
-
MD5
7de29c87f6a9af360cf2ff57ee76e1be
-
SHA1
89aa18b03171330f880e3630484ef38325652b2a
-
SHA256
0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867
-
SHA512
048dea7ea0c3a22fa693bfbd7692d574e208307f87be49747a2749422d1aa3b6292aca7055a7a1bded420c4e10ad116a7291d411d22c3a11ea4954249972defb
-
SSDEEP
12288:oizeM2EUEUZ3jY19ZRsoAm8itozrIHMlu4FLpOjWtGNgDUiWqWNKDrt2j:oiqM2CTZKHtitP4FVOjWcCDUiWBwrkj
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 860 rundll32.exe -
Suspicious use of SetWindowsHookEx 61 IoCs
pid Process 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe 860 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 684 wrote to memory of 860 684 rundll32.exe 27 PID 684 wrote to memory of 860 684 rundll32.exe 27 PID 684 wrote to memory of 860 684 rundll32.exe 27 PID 684 wrote to memory of 860 684 rundll32.exe 27 PID 684 wrote to memory of 860 684 rundll32.exe 27 PID 684 wrote to memory of 860 684 rundll32.exe 27 PID 684 wrote to memory of 860 684 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:860
-