3a5e116b359d24af75291197fc88241689dd9799504e1761b86326866d5d6037

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 04:54

Target

0f2edf07a9ba7968b82b13b290b17019.dll
Size

41KB
MD5

0f2edf07a9ba7968b82b13b290b17019
SHA1

52c899cfac032d8ceb6c87d06f2167f4fb4efad7
SHA256

3a5e116b359d24af75291197fc88241689dd9799504e1761b86326866d5d6037
SHA512

1e92a8afb8db4856e0ee80ce8f93c90976e900c8bbd115dca9beec85739721433ee911ad4a7869ff3b103444cbee181ca70609ab885177e4756574f7f32eee45
SSDEEP

768:rGu8NTJ5NLiNx+JABKN8WKJg7PBptwbWcZj3ko53Rhk:yu8NN5NGNxmAIN8WKJgVrwtZf3Rhk

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\espter.sys	rundll32.exe
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2012	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2012	2004	rundll32.exe	16
PID 2004 wrote to memory of 2012	2004	rundll32.exe	16
PID 2004 wrote to memory of 2012	2004	rundll32.exe	16
PID 2004 wrote to memory of 2012	2004	rundll32.exe	16
PID 2004 wrote to memory of 2012	2004	rundll32.exe	16
PID 2004 wrote to memory of 2012	2004	rundll32.exe	16
PID 2004 wrote to memory of 2012	2004	rundll32.exe	16
PID 2012 wrote to memory of 1404	2012	rundll32.exe	7

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1404
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f2edf07a9ba7968b82b13b290b17019.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004

memory/1404-3-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download