Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 12:07
Behavioral task
behavioral1
Sample
d6ea59d470fd3907bcc97e0baebea1124f53b7e864bdf88afef070b6b02bacfe.dll
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d6ea59d470fd3907bcc97e0baebea1124f53b7e864bdf88afef070b6b02bacfe.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
d6ea59d470fd3907bcc97e0baebea1124f53b7e864bdf88afef070b6b02bacfe.dll
-
Size
42KB
-
MD5
b8e94d34791b95a0ef04c853dbcc53a2
-
SHA1
96a0165c7aa830d827b1f84e3385e483ae771be0
-
SHA256
d6ea59d470fd3907bcc97e0baebea1124f53b7e864bdf88afef070b6b02bacfe
-
SHA512
f89fe71b1158decffc78e568a61782e6ec241a7ef361b74ff251822626db61ba5fb2282a5519c148d4b8eebd04f990252b383a4e7acb68dc5864e4ebe96ea086
-
SSDEEP
768:3efzvAS3R3qJKW/KQ690u88VL+rKrXECliOwOfToTQshLcxnha59:K88W/hmTxB16goTQstC
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1980 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 800 wrote to memory of 1980 800 rundll32.exe 28 PID 800 wrote to memory of 1980 800 rundll32.exe 28 PID 800 wrote to memory of 1980 800 rundll32.exe 28 PID 800 wrote to memory of 1980 800 rundll32.exe 28 PID 800 wrote to memory of 1980 800 rundll32.exe 28 PID 800 wrote to memory of 1980 800 rundll32.exe 28 PID 800 wrote to memory of 1980 800 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d6ea59d470fd3907bcc97e0baebea1124f53b7e864bdf88afef070b6b02bacfe.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d6ea59d470fd3907bcc97e0baebea1124f53b7e864bdf88afef070b6b02bacfe.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980
-