c8c566fcfaaff1928b49e6d10baba523bf601cf81cf4943f90bc9f09922b2a62

Analysis

max time kernel
131s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 15:53

Target

3a75a55542e7492de47886124c57c694.dll
Size

11KB
MD5

3a75a55542e7492de47886124c57c694
SHA1

48032ce3186d119f2f152aee7986e0abc62d7bf5
SHA256

c8c566fcfaaff1928b49e6d10baba523bf601cf81cf4943f90bc9f09922b2a62
SHA512

dfbc83af962db09e8d31d942535abb841063f34cfbbbaf53ca3d6e4d7d163f9c6035ace3c0582c6bcae20f5c51df1aac03d81653f1ed19950acffae796db492d
SSDEEP

192:amUm0TZeITCocYGWf/IeUK3Gg9m9fziRa/5jp3VpBReo+4Crv5YOveM8mYekgUwl:OTxHc7WdH9TWdVjkl4CrWO2zs

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 4844	880	rundll32.exe	90
PID 880 wrote to memory of 4844	880	rundll32.exe	90
PID 880 wrote to memory of 4844	880	rundll32.exe	90
PID 4844 wrote to memory of 3480	4844	rundll32.exe	57

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a75a55542e7492de47886124c57c694.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3a75a55542e7492de47886124c57c694.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4844

memory/4844-0-0x000000000F000000-0x000000000F016000-memory.dmp

Filesize
88KB

Download