Overview

overview

3

Static

static

3

5db7b68c27...01.dll

windows7-x64

3

5db7b68c27...01.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    143s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-08-2023 20:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5db7b68c271c734923c58e79ca334dca8f4cf11bc60b4fd6fbf8e919d10cd201.dll

  • Size

    274KB

  • MD5

    6f987e223d5e14f3119c0f51b0fdcc4c

  • SHA1

    fd26e1af449009a941f70e1fad7af33d92be1e6a

  • SHA256

    5db7b68c271c734923c58e79ca334dca8f4cf11bc60b4fd6fbf8e919d10cd201

  • SHA512

    bd0e7f57ec5a9332d5b622cfd8f2ffe7d219cd2774bb1b096ef69e80edca37d76c400bd46bbab1cc687fe2c38beda6539d80013e65896e8211c1d04664d67fee

  • SSDEEP

    6144:2mq85BySZPmcK6O3ry6FhD8/NoTggZ1KnLkwG:2pqBy2BZUF0oTFZ1e

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5db7b68c271c734923c58e79ca334dca8f4cf11bc60b4fd6fbf8e919d10cd201.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\system32\notepad.exe
      notepad.exe
      2⤵
        PID:660

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1088-134-0x0000000000D20000-0x0000000000D32000-memory.dmp
      Filesize

      72KB

      Download
    • memory/1088-133-0x00007FF903B90000-0x00007FF903D85000-memory.dmp
      Filesize

      2.0MB

      Download
    • memory/1088-136-0x00007FF8E5EA0000-0x00007FF8E6961000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/1088-137-0x000000001B030000-0x000000001B040000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1088-138-0x000000001B030000-0x000000001B040000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1088-139-0x00007FF8E5EA0000-0x00007FF8E6961000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/1088-140-0x000000001B030000-0x000000001B040000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1088-141-0x000000001B030000-0x000000001B040000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1088-142-0x000000001B030000-0x000000001B040000-memory.dmp
      Filesize

      64KB

      Download