Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
21-04-2023 01:19
General
-
Target
c0f8aeeb2d11c6e751ee87c40ee609aceb1c1036706a5af0d3d78738b6cc4125.dll
-
Size
1.4MB
-
MD5
46fe07c07fd0f45ba45240ef9aae2a44
-
SHA1
b918f97c7c6ebc9594de3c8f2d9d75ecc292d02b
-
SHA256
c0f8aeeb2d11c6e751ee87c40ee609aceb1c1036706a5af0d3d78738b6cc4125
-
SHA512
a00f0782b3ee721ef161bce5e8c5e38198997e29a1437f5e120fddb09ecc24cc714d2f6ae846c7d5b9b37694e70da65258b0b3524d9791deb2990b9769e27d03
-
SSDEEP
24576:EX7WvOSS14JVij1xUoY/7l1lTZ1u8vH9QKay98Agc:A7uV21e7fltKyOAX
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 7 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c0f8aeeb2d11c6e751ee87c40ee609aceb1c1036706a5af0d3d78738b6cc4125.dll,#11⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken