e4f931cef27534daf5b7f4b3386f43ec8644432f4f41caaebadd4d6ddd99aefb

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 11:42

Target

9b94ea0912a7075045ba47daf476bce3.dll
Size

16KB
MD5

9b94ea0912a7075045ba47daf476bce3
SHA1

d23aa24aa80f9dab3720f4e97b04805305f52edf
SHA256

e4f931cef27534daf5b7f4b3386f43ec8644432f4f41caaebadd4d6ddd99aefb
SHA512

0a6ae95523db9897c1a7ddeb6777cc2be2df050572c845c8ebf6b9e35f7d773c321972c87d3c55e139ad11c6431d365958f9d26c5de50347da5a8016ae693e7d
SSDEEP

384:/xNat3zL4B98BrLDJRUlYUb0pnAKrRbj+pOV+YV/B4gNZgVLjUIS:/y2gRjBV0pOVXBtsVLjRS

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\terple.sys	rundll32.exe
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1748	1760	rundll32.exe	28
PID 1760 wrote to memory of 1748	1760	rundll32.exe	28
PID 1760 wrote to memory of 1748	1760	rundll32.exe	28
PID 1760 wrote to memory of 1748	1760	rundll32.exe	28
PID 1760 wrote to memory of 1748	1760	rundll32.exe	28
PID 1760 wrote to memory of 1748	1760	rundll32.exe	28
PID 1760 wrote to memory of 1748	1760	rundll32.exe	28
PID 1748 wrote to memory of 1368	1748	rundll32.exe	9

memory/1368-5-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/1748-0-0x000000000F000000-0x000000000F01D000-memory.dmp

Filesize
116KB

Download
memory/1748-1-0x000000000F000000-0x000000000F01D000-memory.dmp

Filesize
116KB

Download