Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 12:55
Static task
static1
Behavioral task
behavioral1
Sample
df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7.dll
Resource
win10v2004-20231215-en
General
-
Target
df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7.dll
-
Size
397KB
-
MD5
733d32873f18c96dfb86fcf7b9edf1b7
-
SHA1
14816d26577d65c2f5b49fc6726e82bb2dea8c72
-
SHA256
df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7
-
SHA512
284e47e05c41d15e6520e413d5f3463ebb21860e093ee39454c07cbbe5a52baa06b5aef6c6f54b11baed7b4dff3daecb87c5b2bed5625cd0f0694d4bd61bf307
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOav:174g2LDeiPDImOkx2LIav
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2212 rundll32.exe 2212 rundll32.exe 2212 rundll32.exe 2212 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2212 rundll32.exe Token: SeTcbPrivilege 2212 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1920 wrote to memory of 2212 1920 rundll32.exe 28 PID 1920 wrote to memory of 2212 1920 rundll32.exe 28 PID 1920 wrote to memory of 2212 1920 rundll32.exe 28 PID 1920 wrote to memory of 2212 1920 rundll32.exe 28 PID 1920 wrote to memory of 2212 1920 rundll32.exe 28 PID 1920 wrote to memory of 2212 1920 rundll32.exe 28 PID 1920 wrote to memory of 2212 1920 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\df241ce41007392d47172b33b030c3fa962f7478322c305b8123aba75435a7e7.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212
-