Analysis
-
max time kernel
135s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 18:10
Static task
static1
Behavioral task
behavioral1
Sample
356f5813e7a688eb0320fcd586e2898580387b329e675b514fb3189deead098d.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
356f5813e7a688eb0320fcd586e2898580387b329e675b514fb3189deead098d.dll
Resource
win10v2004-20220812-en
General
-
Target
356f5813e7a688eb0320fcd586e2898580387b329e675b514fb3189deead098d.dll
-
Size
33KB
-
MD5
a11e5cc38d868f17a2f8bca51a1c9830
-
SHA1
66773c7d47764f4ba75977bcd4c9b6971dae2713
-
SHA256
356f5813e7a688eb0320fcd586e2898580387b329e675b514fb3189deead098d
-
SHA512
c30f85f36545fbe91331fc29510bfe6147e6f745adae4e0bb90b773f5a37fc2dc6f36bfeb14d52d82e47bac603d1f86acfb3a033427014fe325a5ecc40612b7e
-
SSDEEP
768:I+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:I+av6qZ4QxpP0AtNfRJ5BHxY
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4840 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4984 wrote to memory of 4840 4984 rundll32.exe 80 PID 4984 wrote to memory of 4840 4984 rundll32.exe 80 PID 4984 wrote to memory of 4840 4984 rundll32.exe 80
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\356f5813e7a688eb0320fcd586e2898580387b329e675b514fb3189deead098d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\356f5813e7a688eb0320fcd586e2898580387b329e675b514fb3189deead098d.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
PID:4840
-