e4f931cef27534daf5b7f4b3386f43ec8644432f4f41caaebadd4d6ddd99aefb

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 11:42

Target

9b94ea0912a7075045ba47daf476bce3.dll
Size

16KB
MD5

9b94ea0912a7075045ba47daf476bce3
SHA1

d23aa24aa80f9dab3720f4e97b04805305f52edf
SHA256

e4f931cef27534daf5b7f4b3386f43ec8644432f4f41caaebadd4d6ddd99aefb
SHA512

0a6ae95523db9897c1a7ddeb6777cc2be2df050572c845c8ebf6b9e35f7d773c321972c87d3c55e139ad11c6431d365958f9d26c5de50347da5a8016ae693e7d
SSDEEP

384:/xNat3zL4B98BrLDJRUlYUb0pnAKrRbj+pOV+YV/B4gNZgVLjUIS:/y2gRjBV0pOVXBtsVLjRS

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File created	C:\Windows\SysWOW64\terple.sys	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3892	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 3892	1356	rundll32.exe	83
PID 1356 wrote to memory of 3892	1356	rundll32.exe	83
PID 1356 wrote to memory of 3892	1356	rundll32.exe	83
PID 3892 wrote to memory of 3524	3892	rundll32.exe	48

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b94ea0912a7075045ba47daf476bce3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b94ea0912a7075045ba47daf476bce3.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3892

memory/3892-0-0x000000000F000000-0x000000000F01D000-memory.dmp

Filesize
116KB

Download