Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
15-05-2023 22:48
General
-
Target
sample2.dll
-
Size
378KB
-
MD5
f66637b3a6173fdd36a0fa7b8363e603
-
SHA1
0755522db43dd0f314636f74153517148e281e88
-
SHA256
695d8751897ea00816875374e0cd7df5e1e1a2f26d29c63647708fe4c649168c
-
SHA512
f68a4cf7bcd7b62b0fd2390b87e852f388e091fdabced8e9fb00c69d513abf1cdba00e6c5b75f852a135738196592cd313b505afc4163c92bc5be492fce5afab
-
SSDEEP
6144:jstnb/4misK1vTrwKrdumJ9QbFQUU9YNj/GW9wz29nH9laVgm1GChaIdVNoxB6MT:A5/jisK1vQKrduY+FQ39YNj/H2QnW3w1
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 18 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sample2.dll,#11⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken