Analysis
-
max time kernel
93s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
arch:x64arch:x86image:win10v2004-20231201-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2023, 20:33
Behavioral task
behavioral1
Sample
050485c7dda353a41757745db9aabb025e190d960b3d641250e03dbcb26a0f11.dll
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
050485c7dda353a41757745db9aabb025e190d960b3d641250e03dbcb26a0f11.dll
Resource
win10v2004-20231201-en
General
-
Target
050485c7dda353a41757745db9aabb025e190d960b3d641250e03dbcb26a0f11.dll
-
Size
5.6MB
-
MD5
19c5bc67c341a3f5f0e564bf2a63bbd8
-
SHA1
4237f0e61027d32e958bab15fa91faacc5c8e540
-
SHA256
050485c7dda353a41757745db9aabb025e190d960b3d641250e03dbcb26a0f11
-
SHA512
005053ccc046589728e25d9eefb6e9a8c06b3e151de0e2c8be1fb68be54a4914b5248f8b5bc2bbdc0cd58ff0e660aeb8ba39141a97a1bf069f8e097eaf543f48
-
SSDEEP
98304:Ql8suaIBaehgNK/ldAZQ53bZe/M3jMWnOI02eSSdp4bZUBQlmjS8zg0OLb7iCzOW:QGgG9c0rZTYDIbeSspI3uSLbWk
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2352-1-0x0000000074E60000-0x00000000757A2000-memory.dmp vmprotect behavioral2/memory/2352-2-0x0000000074E60000-0x00000000757A2000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe 2352 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2352 rundll32.exe Token: SeLoadDriverPrivilege 2352 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2352 3012 rundll32.exe 86 PID 3012 wrote to memory of 2352 3012 rundll32.exe 86 PID 3012 wrote to memory of 2352 3012 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\050485c7dda353a41757745db9aabb025e190d960b3d641250e03dbcb26a0f11.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\050485c7dda353a41757745db9aabb025e190d960b3d641250e03dbcb26a0f11.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352
-