Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18-01-2024 07:42
General
-
Target
64d94bce7281dfe6fb97939c6651fce3.dll
-
Size
300KB
-
MD5
64d94bce7281dfe6fb97939c6651fce3
-
SHA1
515db6800d549a709d38968504f8850d164993fd
-
SHA256
04edb707b27632711b78f98fe66b3f9a78de04624e4f65e551035c0a193dbc3d
-
SHA512
88df482565d31f94bae29565f969db6f0f21ee8352c573bef26b227352785b0de17a9e78ada30b303ee85db37c9fb7e3a5267a1c46264c411f07d1705d80caa9
-
SSDEEP
6144:uA2iBzok8ag9cMDXexovX+Wo22HbbfTcnmWG0EM8ZCzERln:uAHGk8T9cMDXexoPdovHbbfomWG0usw9
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64d94bce7281dfe6fb97939c6651fce3.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64d94bce7281dfe6fb97939c6651fce3.dll,#13⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-