Analysis
-
max time kernel
154s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 10:54
Static task
static1
Behavioral task
behavioral1
Sample
0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867.dll
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867.dll
-
Size
740KB
-
MD5
7de29c87f6a9af360cf2ff57ee76e1be
-
SHA1
89aa18b03171330f880e3630484ef38325652b2a
-
SHA256
0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867
-
SHA512
048dea7ea0c3a22fa693bfbd7692d574e208307f87be49747a2749422d1aa3b6292aca7055a7a1bded420c4e10ad116a7291d411d22c3a11ea4954249972defb
-
SSDEEP
12288:oizeM2EUEUZ3jY19ZRsoAm8itozrIHMlu4FLpOjWtGNgDUiWqWNKDrt2j:oiqM2CTZKHtitP4FVOjWcCDUiWBwrkj
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 32 rundll32.exe -
Suspicious use of SetWindowsHookEx 61 IoCs
pid Process 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe 32 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2280 wrote to memory of 32 2280 rundll32.exe 82 PID 2280 wrote to memory of 32 2280 rundll32.exe 82 PID 2280 wrote to memory of 32 2280 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0d9a7b4c9b0901d66e34594e4410753d151cd72a384401a711e94b7288ed0867.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:32
-