ebf7097ae8e20c7d483db45cd82232f6791586be67df3d290c0238159ee5a646

Analysis

max time kernel
145s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 22:11

Target

1e12aac907f633fa544c0f04239b0ca9.dll
Size

24KB
MD5

1e12aac907f633fa544c0f04239b0ca9
SHA1

409dcfc56f51783aebe7fdd2eaf0cd9af2537415
SHA256

ebf7097ae8e20c7d483db45cd82232f6791586be67df3d290c0238159ee5a646
SHA512

f1988aba2c3c13cab9e5b8b8a0ee55f1c984cf6f5bb8d9223c7614a1def9915fb62b34e362299c3a7cb1b5d33a86120745a7d570c245dcd2dafbb1b17b6a2fd0
SSDEEP

384:0W5ihNTgs7sm/X7CpjCblPPll/AiI/hXSxYwbw1cZAq3I:0W4sMs0X7CpjwNPD/OtwbWcZL3I

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3568	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3568	4436	rundll32.exe	46
PID 4436 wrote to memory of 3568	4436	rundll32.exe	46
PID 4436 wrote to memory of 3568	4436	rundll32.exe	46
PID 3568 wrote to memory of 3496	3568	rundll32.exe	47

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e12aac907f633fa544c0f04239b0ca9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e12aac907f633fa544c0f04239b0ca9.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3568