e0a3941561088631a4c0234d02dcb2fbefe2f8e2870dacf77f6c9754bcb8bb20

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2024 17:50

Target

702f6d8705f0991e7abf8344f6aa0743.dll
Size

32KB
MD5

702f6d8705f0991e7abf8344f6aa0743
SHA1

4ec5e7843dd71c84f493b5b63b41c1a2ffca416b
SHA256

e0a3941561088631a4c0234d02dcb2fbefe2f8e2870dacf77f6c9754bcb8bb20
SHA512

2881315e59092c8a8e73b3819ec9fb0836cdbb05100f58563679bec1cd5bdbcbbb8e7dd86d0dda4d131a619802a58b74c1eda6e0443ff757712d819648534d19
SSDEEP

384:Z/DoN5a2Lmxm/TYflFNBVqmP8OR/7nJnCJH+gvZJlplTQ:Z/8Pa2yw/TYflFNBVqmPnCJH+UZDfQ

Score

5^/10

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ghrst.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ghrst.dll	rundll32.exe
File created	C:\Windows\SysWOW64\ethyg.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ethyg.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 968	1304	rundll32.exe	16
PID 1304 wrote to memory of 968	1304	rundll32.exe	16
PID 1304 wrote to memory of 968	1304	rundll32.exe	16
PID 968 wrote to memory of 3420	968	rundll32.exe	44
PID 968 wrote to memory of 3420	968	rundll32.exe	44
PID 968 wrote to memory of 1504	968	rundll32.exe	63
PID 968 wrote to memory of 1504	968	rundll32.exe	63

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\702f6d8705f0991e7abf8344f6aa0743.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\702f6d8705f0991e7abf8344f6aa0743.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:968