283765c310eff2ec907eb802484f6b9e6abc80436e7f1318aa1554d058aa8192

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 01:45

Target

lpk.dll
Size

45KB
MD5

253047ba1fb3f5780f656e42468a98b6
SHA1

41df12eff92915354f6870ece0fe09c03e96eaa4
SHA256

5ab6d1bc176cc636e82dca6c557c49d06f06016d829aca6cec4761624231ce6d
SHA512

1866f515851eaa71c4213a4680f239b88b38e88371a3414e3f7079321b740e45fa36c96304eb55e09c16a83532b4fa4c466f5fd3bf947e46cfcd8cb4c96b6dc3
SSDEEP

768:tojY9P93amUkTe2uVf8VPZUpRwqK8RPRDUbojyH6ojY9P:Ym1a9iexVfevagojyHDm

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
1052	hrl83D0.tmp
1168	rifzsk.exe

Loads dropped DLL 2 IoCs

pid	Process
1276	rundll32.exe
1276	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rifzsk.exe	hrl83D0.tmp
File opened for modification	C:\Windows\SysWOW64\rifzsk.exe	hrl83D0.tmp

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1168 set thread context of 2740	1168	rifzsk.exe	31

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1276	1700	rundll32.exe	28
PID 1700 wrote to memory of 1276	1700	rundll32.exe	28
PID 1700 wrote to memory of 1276	1700	rundll32.exe	28
PID 1700 wrote to memory of 1276	1700	rundll32.exe	28
PID 1700 wrote to memory of 1276	1700	rundll32.exe	28
PID 1700 wrote to memory of 1276	1700	rundll32.exe	28
PID 1700 wrote to memory of 1276	1700	rundll32.exe	28
PID 1276 wrote to memory of 1052	1276	rundll32.exe	29
PID 1276 wrote to memory of 1052	1276	rundll32.exe	29
PID 1276 wrote to memory of 1052	1276	rundll32.exe	29
PID 1276 wrote to memory of 1052	1276	rundll32.exe	29
PID 1168 wrote to memory of 2740	1168	rifzsk.exe	31
PID 1168 wrote to memory of 2740	1168	rifzsk.exe	31
PID 1168 wrote to memory of 2740	1168	rifzsk.exe	31
PID 1168 wrote to memory of 2740	1168	rifzsk.exe	31
PID 1168 wrote to memory of 2740	1168	rifzsk.exe	31
PID 1168 wrote to memory of 2740	1168	rifzsk.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\Temp\hrl83D0.tmp
    C:\Users\Admin\AppData\Local\Temp\hrl83D0.tmp
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1052

\Users\Admin\AppData\Local\Temp\hrl83D0.tmp

Filesize
37KB

MD5
e90d8273d9f418adc5c2cb4e1e995559

SHA1
e7dff32bc9671d85e347415f5d5011acdd8aa9e6

SHA256
514319a4883c27820f1f08581aa3a0853643015ee0f4ec742739c118b327bdb1

SHA512
1dbf053d564039ca8c80f7fd6989dbdb42b191da6bbd70c97f81f41567891d6672910dd9c736a32146c896e2159677b41b3e46007ce70d9d4d9ea223a6b8a6d7

Download Submit
memory/2740-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2740-14-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2740-16-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download