1584fe5cf3b14c738ab0e5a3b39c0f0f4c2f5bcd9cd2c898d899c967fb9c1461

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 06:43

Target

8e7aacd9669eb2c72dc6db9fd6af3b70.dll
Size

41KB
MD5

8e7aacd9669eb2c72dc6db9fd6af3b70
SHA1

5d972f65e9f31cf39afc9d032136943ac39b92f0
SHA256

1584fe5cf3b14c738ab0e5a3b39c0f0f4c2f5bcd9cd2c898d899c967fb9c1461
SHA512

16c695d2f5a345a29cf913a23fedad351eeaaab0935a776566d93f21c891fb3164cd95a61fe48184b8bf51cb8b6d2aaff07e2a2519b343bc2e5534c38d4d477a
SSDEEP

768:rGu8NTJ5NLiNx+JABKN8WKJg7PBptwbWcZj3ko53RhY:yu8NN5NGNxmAIN8WKJgVrwtZf3RhY

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\espter.sys	rundll32.exe
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 5028	4804	rundll32.exe	73
PID 4804 wrote to memory of 5028	4804	rundll32.exe	73
PID 4804 wrote to memory of 5028	4804	rundll32.exe	73
PID 5028 wrote to memory of 3404	5028	rundll32.exe	58

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e7aacd9669eb2c72dc6db9fd6af3b70.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8e7aacd9669eb2c72dc6db9fd6af3b70.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5028