94ea29174d56f7a5f8e9ce771e742f5e61b17f13d8202a3487029c655c80bdd0

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:18

Target

94ea29174d56f7a5f8e9ce771e742f5e61b17f13d8202a3487029c655c80bdd0.dll
Size

12KB
MD5

0e94dbaece806e78f0c049d593086184
SHA1

681f4a3cefeb2383f675f6f3f7d9a6a8706625f5
SHA256

94ea29174d56f7a5f8e9ce771e742f5e61b17f13d8202a3487029c655c80bdd0
SHA512

0d4615a2eaaadfe9117c8d9e571c8e3ce4b9af8b15b47d17f29a198175c499d226df29c3e28f404f82b564d51ab4e2db0c7d994e677da4d4aa152b1671ff7eba
SSDEEP

384:3XtK1sDW8shyXZG/VwavB4FW+6CII7+u2:3dK138shWgdw/gAqj

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\HowArMe.reg	rundll32.exe
File created	C:\Windows\HowArMe.txt	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
628	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	628	rundll32.exe
Token: SeRestorePrivilege	628	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27
PID 960 wrote to memory of 628	960	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\94ea29174d56f7a5f8e9ce771e742f5e61b17f13d8202a3487029c655c80bdd0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\94ea29174d56f7a5f8e9ce771e742f5e61b17f13d8202a3487029c655c80bdd0.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:628

memory/628-55-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download