f4f640b5ba7a832b306fc9dbc3a56fc6cee5f3e0c335b4adc107b8713b6ee933 | Triage

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2024 18:19

Sharing

Report Analysis Logs

General

Target

72b8ff56f82ae38689b793fe665b3096.dll
Size

39KB
MD5

72b8ff56f82ae38689b793fe665b3096
SHA1

f29af51978bf8088cfcc202f07fa6dfdad7d131e
SHA256

f4f640b5ba7a832b306fc9dbc3a56fc6cee5f3e0c335b4adc107b8713b6ee933
SHA512

2938fbc7b89dd4a548383bb1cd4fc0fdd66d50bbb0e62e49c55e094f4c19e3b55716d1b552a2456ec9fa44613a75c24433256f8e82f26e675c65b4009a27a13f
SSDEEP

768:yrb3Py+7hym9DQla8hcVC1PBti3z+UZgwRU:IfyM79Mla8mVCbt+NZgwO

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hujfgt.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\hujfgt.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe
3980	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3980	rundll32.exe
Token: SeDebugPrivilege	3980	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 3980	912	rundll32.exe	84
PID 912 wrote to memory of 3980	912	rundll32.exe	84
PID 912 wrote to memory of 3980	912	rundll32.exe	84
PID 3980 wrote to memory of 3404	3980	rundll32.exe	54
PID 3980 wrote to memory of 3404	3980	rundll32.exe	54

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3404
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\72b8ff56f82ae38689b793fe665b3096.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\72b8ff56f82ae38689b793fe665b3096.dll,#1
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads