Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
23/11/2023, 23:59
Static task
static1
Behavioral task
behavioral1
Sample
2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d.dll
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d.dll
Resource
win10v2004-20231020-en
General
-
Target
2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d.dll
-
Size
4.6MB
-
MD5
820fc5d1ec7553fea741b2811c47e937
-
SHA1
0ec7d84244f5e37bf62e43e58d60f09cf868695c
-
SHA256
2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d
-
SHA512
76786cedeef4d1a5d7b62df7a77af3a1d8e7882c10b596f24b038f9d28c879d0e7d89ebedb617d094a12eab5b2bc82bbcc92d06d5d69174f91e0a853962c188b
-
SSDEEP
49152:+ZcP5u3RYiQH3kifUQzGC98+4CKs41EccMpPDgU1J0jRqkqUH6:tP5UFsUQzGa8+4Cy2spLN1Jxt
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2816 rundll32.exe 2816 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2816 rundll32.exe Token: SeDebugPrivilege 2816 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2816 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2816 2932 rundll32.exe 28 PID 2932 wrote to memory of 2816 2932 rundll32.exe 28 PID 2932 wrote to memory of 2816 2932 rundll32.exe 28 PID 2932 wrote to memory of 2816 2932 rundll32.exe 28 PID 2932 wrote to memory of 2816 2932 rundll32.exe 28 PID 2932 wrote to memory of 2816 2932 rundll32.exe 28 PID 2932 wrote to memory of 2816 2932 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f6aa723011a8615306823fa5d57d1c25c0dcc847187f3b73265776cfd63602d.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2816
-