44fc6f1ddf762ce0718ccd17a0f9c64af04065ab3cf3d8a350eb6a69061f2213

Analysis

max time kernel
122s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:59

Target

370745c909a3c059e59ab1695f995ac4.dll
Size

47KB
MD5

370745c909a3c059e59ab1695f995ac4
SHA1

51b178af6b4d0d4a1cafc85b3a6bcfac4b185e07
SHA256

44fc6f1ddf762ce0718ccd17a0f9c64af04065ab3cf3d8a350eb6a69061f2213
SHA512

5caab34651fe7771f36025e7d06dbee7265ea7b49a2131d5aa2baabcfc25c1d6f93f2b0d3d4dcffb7b16623080d1d6f3cca7f7260a1fe08152e1f1346fbcf467
SSDEEP

768:frz6XkhDWsdaT0vgB0wUBjTkFlKEOPHM97idj+RZ46BuC28Yf:frz6XmDjaAvgB0wcfkFlK5MpuwZ4e2

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dehkj.dll	rundll32.exe
File created	C:\Windows\SysWOW64\dtrgjy.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\dtrgjy.dll	rundll32.exe
File created	C:\Windows\SysWOW64\dehkj.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2400	2888	rundll32.exe	29
PID 2888 wrote to memory of 2400	2888	rundll32.exe	29
PID 2888 wrote to memory of 2400	2888	rundll32.exe	29
PID 2888 wrote to memory of 2400	2888	rundll32.exe	29
PID 2888 wrote to memory of 2400	2888	rundll32.exe	29
PID 2888 wrote to memory of 2400	2888	rundll32.exe	29
PID 2888 wrote to memory of 2400	2888	rundll32.exe	29
PID 2400 wrote to memory of 1256	2400	rundll32.exe	8
PID 2400 wrote to memory of 1256	2400	rundll32.exe	8
PID 2400 wrote to memory of 988	2400	rundll32.exe	12
PID 2400 wrote to memory of 988	2400	rundll32.exe	12

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\370745c909a3c059e59ab1695f995ac4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\370745c909a3c059e59ab1695f995ac4.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2400

memory/1256-2-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download