3a5e116b359d24af75291197fc88241689dd9799504e1761b86326866d5d6037

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 04:54

Target

0f2edf07a9ba7968b82b13b290b17019.dll
Size

41KB
MD5

0f2edf07a9ba7968b82b13b290b17019
SHA1

52c899cfac032d8ceb6c87d06f2167f4fb4efad7
SHA256

3a5e116b359d24af75291197fc88241689dd9799504e1761b86326866d5d6037
SHA512

1e92a8afb8db4856e0ee80ce8f93c90976e900c8bbd115dca9beec85739721433ee911ad4a7869ff3b103444cbee181ca70609ab885177e4756574f7f32eee45
SSDEEP

768:rGu8NTJ5NLiNx+JABKN8WKJg7PBptwbWcZj3ko53Rhk:yu8NN5NGNxmAIN8WKJgVrwtZf3Rhk

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\espter.sys	rundll32.exe
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 2876	4320	rundll32.exe	88
PID 4320 wrote to memory of 2876	4320	rundll32.exe	88
PID 4320 wrote to memory of 2876	4320	rundll32.exe	88
PID 2876 wrote to memory of 3596	2876	rundll32.exe	42

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f2edf07a9ba7968b82b13b290b17019.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0f2edf07a9ba7968b82b13b290b17019.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2876