Analysis
-
max time kernel
115s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 12:21
Static task
static1
Behavioral task
behavioral1
Sample
92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1.dll
Resource
win10v2004-20220812-en
General
-
Target
92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1.dll
-
Size
213KB
-
MD5
3f246fb88bc239f57d5409ec03cefe3a
-
SHA1
982dfeb26b66ed49be7df6683a5576e3a07ef43f
-
SHA256
92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1
-
SHA512
4c082ff5b887a76d623050294548c1b9e58a4d327cdafa55924bfc1fd1409875ab1e311afe4423c3e41d088c372a1fdd857053d59dc5a3453c68469738d5c91a
-
SSDEEP
192:qfumXeHfKPwAGV559q6SAEmFWH2o1wXEBmHd/aeu3YJwC+nq7AVZkgUw9E:sufiPwV559q6nEmFy1wXYeohC+qsVWP
Malware Config
Signatures
-
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 668 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4948 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4948 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4948 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3016 wrote to memory of 4948 3016 rundll32.exe 79 PID 3016 wrote to memory of 4948 3016 rundll32.exe 79 PID 3016 wrote to memory of 4948 3016 rundll32.exe 79
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92c5564baf9b67acddc1e14962885ed273a87bc8fe53052fffb3cfcdba73fce1.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4948
-