3efb8fa195ea3462b4ac65d4636e8e24944829823b327e276aa3658e6c4d302b

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 22:52

Target

1f0ebbc8683a948b8d3c679251b0813f.dll
Size

31KB
MD5

1f0ebbc8683a948b8d3c679251b0813f
SHA1

a68793b2885ba0b8f6779aa737f01da6329436ac
SHA256

3efb8fa195ea3462b4ac65d4636e8e24944829823b327e276aa3658e6c4d302b
SHA512

407e44796555352fed41380ee1f836ddca4b8e15a2babc3fae23654543929ddddf190500aa9c53d9f7aafe91c6dade99b49f59b21c84e12bfb529a7e3e6951e4
SSDEEP

768:aYQs6zYeHhZ/Hu1iqFgMvDxoxWU3Pk2BD+UZeq:FQs6zfHhZPu1TgMvDxowUc2dZt

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fnhwe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\fnhwe.dll	rundll32.exe
File created	C:\Windows\SysWOW64\fyrgtr.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\fyrgtr.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2964	2304	rundll32.exe	28
PID 2304 wrote to memory of 2964	2304	rundll32.exe	28
PID 2304 wrote to memory of 2964	2304	rundll32.exe	28
PID 2304 wrote to memory of 2964	2304	rundll32.exe	28
PID 2304 wrote to memory of 2964	2304	rundll32.exe	28
PID 2304 wrote to memory of 2964	2304	rundll32.exe	28
PID 2304 wrote to memory of 2964	2304	rundll32.exe	28
PID 2964 wrote to memory of 1220	2964	rundll32.exe	11
PID 2964 wrote to memory of 1220	2964	rundll32.exe	11
PID 2964 wrote to memory of 296	2964	rundll32.exe	14
PID 2964 wrote to memory of 296	2964	rundll32.exe	14

memory/1220-2-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download