5c4d5d9ef4fb5f630ec7987caccab2954cbebbb100ab0a64c5db83f5c65750c5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 20:46

Target

41df7434bbd4f4b5277de8d7defcb1c6.dll
Size

24KB
MD5

41df7434bbd4f4b5277de8d7defcb1c6
SHA1

0309dded791faa4a94bd23a5b5e8bc618c064c78
SHA256

5c4d5d9ef4fb5f630ec7987caccab2954cbebbb100ab0a64c5db83f5c65750c5
SHA512

0dc272fb1f200a216689a1874c2b64890e61abb80ea568b8d279b72416982dce8416b3f238e84e364afec14d4b8362c2f5371e5933600c146aa08f1eb31f7f75
SSDEEP

384:9JUhZXJPSpslKbXr55rbKP/xPq/hc9ZYAbw1cZPq160:9qh3PSpaAXr55rbKPunAbWcZC16

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5244	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 5244	3920	rundll32.exe	63
PID 3920 wrote to memory of 5244	3920	rundll32.exe	63
PID 3920 wrote to memory of 5244	3920	rundll32.exe	63
PID 5244 wrote to memory of 3420	5244	rundll32.exe	46

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41df7434bbd4f4b5277de8d7defcb1c6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\41df7434bbd4f4b5277de8d7defcb1c6.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5244