Analysis
-
max time kernel
175s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 23:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f76f68e199d6cf637c00909b8f78051.dll
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f76f68e199d6cf637c00909b8f78051.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
1f76f68e199d6cf637c00909b8f78051.dll
-
Size
43KB
-
MD5
1f76f68e199d6cf637c00909b8f78051
-
SHA1
d1fe298d300e0197ca137cba885681098ef052ec
-
SHA256
fce57a588bc4998e57471472b45cd44179d4c2cfbcccffddef0283359cac6c25
-
SHA512
c1cdd70cc269c5f2079e7e420e889584c7982c9f7d26319a8984e68556d510308bef70103ad7ef3dadd110e62dbb2432a494bddc92217694546cbe6f02bebed8
-
SSDEEP
768:2L9X3RbDKjGT3YWwzNrXGLHPE1H++RZ06BuOE4:O9xbDKjGT3/wzNrXa8BdZ0U
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fydgky.dll rundll32.exe File created C:\Windows\SysWOW64\jkhjsd.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\jkhjsd.dll rundll32.exe File created C:\Windows\SysWOW64\fydgky.dll rundll32.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe 1224 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1224 rundll32.exe Token: SeDebugPrivilege 1224 rundll32.exe Token: SeDebugPrivilege 1224 rundll32.exe Token: SeDebugPrivilege 1224 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1224 2388 rundll32.exe 88 PID 2388 wrote to memory of 1224 2388 rundll32.exe 88 PID 2388 wrote to memory of 1224 2388 rundll32.exe 88 PID 1224 wrote to memory of 3452 1224 rundll32.exe 73 PID 1224 wrote to memory of 3452 1224 rundll32.exe 73 PID 1224 wrote to memory of 1864 1224 rundll32.exe 25 PID 1224 wrote to memory of 1864 1224 rundll32.exe 25
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1864
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1f76f68e199d6cf637c00909b8f78051.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1f76f68e199d6cf637c00909b8f78051.dll,#12⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452