f9541f50b8db360dcd189473c862f2d20332393c00c76fc820df4a264ecd1da5

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:37

Target

24c12dd056a1d3135666c6bd5048b438.dll
Size

27KB
MD5

24c12dd056a1d3135666c6bd5048b438
SHA1

784d51504dba08beff479bdb865466eee874155a
SHA256

f9541f50b8db360dcd189473c862f2d20332393c00c76fc820df4a264ecd1da5
SHA512

e34d071eec2f859b35ffd744ca4b5399085817b7b2cd9f0445d5227c4feca1b95e862653ce4afaa7ef234af1093996c0f6c1bb22db7f183d7411bd92cb952ceb
SSDEEP

384:AWnf6L8XexUdIkyA1wx8yPgH5///izCpH+gvZlI255:AWf6L8XexUyJA1wx8yP0QGpH+UZOG5

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ukrth.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ukrth.dll	rundll32.exe
File created	C:\Windows\SysWOW64\hjmh.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\hjmh.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 3036	2036	rundll32.exe	28
PID 2036 wrote to memory of 3036	2036	rundll32.exe	28
PID 2036 wrote to memory of 3036	2036	rundll32.exe	28
PID 2036 wrote to memory of 3036	2036	rundll32.exe	28
PID 2036 wrote to memory of 3036	2036	rundll32.exe	28
PID 2036 wrote to memory of 3036	2036	rundll32.exe	28
PID 2036 wrote to memory of 3036	2036	rundll32.exe	28
PID 3036 wrote to memory of 1204	3036	rundll32.exe	16
PID 3036 wrote to memory of 1204	3036	rundll32.exe	16
PID 3036 wrote to memory of 976	3036	rundll32.exe	20
PID 3036 wrote to memory of 976	3036	rundll32.exe	20

memory/1204-2-0x0000000001D90000-0x0000000001D91000-memory.dmp

Filesize
4KB

Download