Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06dbe330db261199745d8778058058dd.dll
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
06dbe330db261199745d8778058058dd.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
06dbe330db261199745d8778058058dd.dll
-
Size
980KB
-
MD5
06dbe330db261199745d8778058058dd
-
SHA1
a355efb97f58b860c9fbc2c4039fceb9724c0248
-
SHA256
e5ef8837848d49d7dc7afd7480fc7432c1ee2cec6ebdc12d83c34fa88e5f37e9
-
SHA512
d239c700c33d3fc32ccfda3c6b82f2c35119502431063d1a05a20a5442808ea6f70b4c2293fca0aa108e77cea336cb191e3eff065a572d29dcaa5cb46f15b1b2
-
SSDEEP
12288:MI7xl7vAW7JpuOf9hrDZ7LDvCWsnKNbQ95D4U4pIM/q:MI7xlcAvD/Z3vCWs+Q95DNyt
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1992 1888 WerFault.exe 10 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1888 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1888 rundll32.exe -
Suspicious use of SetWindowsHookEx 25 IoCs
pid Process 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe 1888 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1888 2024 rundll32.exe 10 PID 2024 wrote to memory of 1888 2024 rundll32.exe 10 PID 2024 wrote to memory of 1888 2024 rundll32.exe 10 PID 2024 wrote to memory of 1888 2024 rundll32.exe 10 PID 2024 wrote to memory of 1888 2024 rundll32.exe 10 PID 2024 wrote to memory of 1888 2024 rundll32.exe 10 PID 2024 wrote to memory of 1888 2024 rundll32.exe 10 PID 1888 wrote to memory of 1992 1888 rundll32.exe 17 PID 1888 wrote to memory of 1992 1888 rundll32.exe 17 PID 1888 wrote to memory of 1992 1888 rundll32.exe 17 PID 1888 wrote to memory of 1992 1888 rundll32.exe 17
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06dbe330db261199745d8778058058dd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06dbe330db261199745d8778058058dd.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 3723⤵
- Program crash
PID:1992
-
-