d752776893864b97b4f1892ec8342d591fc9580d7912b88f7e1b10ef8c0d00f1

Analysis

max time kernel
330s
max time network
463s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 21:13

Target

d752776893864b97b4f1892ec8342d591fc9580d7912b88f7e1b10ef8c0d00f1.dll
Size

9KB
MD5

42ae0d666b387cc990acbc579616ee38
SHA1

3575095b79677c12c66b7170ac8f69ca58232e66
SHA256

d752776893864b97b4f1892ec8342d591fc9580d7912b88f7e1b10ef8c0d00f1
SHA512

08b724a2e463c59ca8d0f5130f9f205cc3b5928c8535a6f68c1cb48f83ee4ed2a7cf14b407c5475305ce134920dc27fcc362e2231c42bdd568b3baf3f43fda4d
SSDEEP

192:KLpNp2s09ef+BVnh0YDZw+PlAih/VgS/7sWtEsnkgUw6X:Q2N9vVhxTiiPgcis4l

Score

8^/10

persistence

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 4252	3568	rundll32.exe	81
PID 3568 wrote to memory of 4252	3568	rundll32.exe	81
PID 3568 wrote to memory of 4252	3568	rundll32.exe	81
PID 4252 wrote to memory of 2164	4252	rundll32.exe	42

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4252-133-0x0000000025000000-0x0000000025015000-memory.dmp

Filesize
84KB

Download