9d45afefad846a34f15daffaed3dba7f8791d12a42d643173489b575a937808e

Analysis

max time kernel
160s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 07:02

Target

2c969a36f18e9c62a50f30c2c80b8525.dll
Size

169KB
MD5

2c969a36f18e9c62a50f30c2c80b8525
SHA1

97f14230aa3e461bc5e4494a0ca359dfc1dcbadd
SHA256

9d45afefad846a34f15daffaed3dba7f8791d12a42d643173489b575a937808e
SHA512

7ca7560d49b29893aef425867e226d09dcdffa96b6818e8d86f539cc8deebd338a98f5413442d5460492160291bf6620bf669c1e1dabe26439917ccec45b7a64
SSDEEP

3072:sDtb+l46QACi9dUghrL2lvQjGoCtf4paWS2xLusQFaOx:sh6l4zAP9dPhrLNctQpaWXusQFaO

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\expleror.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\expleror.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3756	rundll32.exe
3756	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	rundll32.exe
Token: SeDebugPrivilege	3756	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 3756	3576	rundll32.exe	15
PID 3576 wrote to memory of 3756	3576	rundll32.exe	15
PID 3576 wrote to memory of 3756	3576	rundll32.exe	15
PID 3756 wrote to memory of 608	3756	rundll32.exe	5

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c969a36f18e9c62a50f30c2c80b8525.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c969a36f18e9c62a50f30c2c80b8525.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3756

memory/3756-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download