Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1.dll
Resource
win10v2004-20220812-en
General
-
Target
92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1.dll
-
Size
213KB
-
MD5
3f246fb88bc239f57d5409ec03cefe3a
-
SHA1
982dfeb26b66ed49be7df6683a5576e3a07ef43f
-
SHA256
92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1
-
SHA512
4c082ff5b887a76d623050294548c1b9e58a4d327cdafa55924bfc1fd1409875ab1e311afe4423c3e41d088c372a1fdd857053d59dc5a3453c68469738d5c91a
-
SSDEEP
192:qfumXeHfKPwAGV559q6SAEmFWH2o1wXEBmHd/aeu3YJwC+nq7AVZkgUw9E:sufiPwV559q6nEmFy1wXYeohC+qsVWP
Malware Config
Signatures
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1168 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1168 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27 PID 1832 wrote to memory of 1168 1832 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1168
-