Analysis
-
max time kernel
218s -
max time network
246s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 07:28
Behavioral task
behavioral1
Sample
f823d357105bfa73334e979dd57f2ec8e573acb8f4bf959dd039b5b98977ce9e.dll
Resource
win7-20221111-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
f823d357105bfa73334e979dd57f2ec8e573acb8f4bf959dd039b5b98977ce9e.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
f823d357105bfa73334e979dd57f2ec8e573acb8f4bf959dd039b5b98977ce9e.dll
-
Size
271KB
-
MD5
4f393cb255e7924b09ee795c9b58ee00
-
SHA1
35eece70fee1cfce6a670d3e9524ace9d3428512
-
SHA256
f823d357105bfa73334e979dd57f2ec8e573acb8f4bf959dd039b5b98977ce9e
-
SHA512
b0790dcb4f6e2a87666db0f949d263945ffae9937878213d7eae63cfd372feef171358fc9d0e8a204b3a0952544775a601b6ed966dcda5d900b5363531a326eb
-
SSDEEP
6144:0qs2R+M5Gt5twmoa9VhxwBa6FxRRBoR1dnujJvWhe:x/5GHt6m2BaErRidktqe
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/360-56-0x0000000010000000-0x00000000100BC000-memory.dmp upx behavioral1/memory/360-57-0x0000000010000000-0x00000000100BC000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe 360 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe Token: SeDebugPrivilege 360 rundll32.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 1500 wrote to memory of 360 1500 rundll32.exe 28 PID 1500 wrote to memory of 360 1500 rundll32.exe 28 PID 1500 wrote to memory of 360 1500 rundll32.exe 28 PID 1500 wrote to memory of 360 1500 rundll32.exe 28 PID 1500 wrote to memory of 360 1500 rundll32.exe 28 PID 1500 wrote to memory of 360 1500 rundll32.exe 28 PID 1500 wrote to memory of 360 1500 rundll32.exe 28 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12 PID 360 wrote to memory of 1192 360 rundll32.exe 12
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f823d357105bfa73334e979dd57f2ec8e573acb8f4bf959dd039b5b98977ce9e.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f823d357105bfa73334e979dd57f2ec8e573acb8f4bf959dd039b5b98977ce9e.dll,#13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:360
-
-