Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll
Resource
win10v2004-20231215-en
General
-
Target
7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll
-
Size
397KB
-
MD5
cb5fe606c0684da3911d73a96b95925b
-
SHA1
cb495ac76819503008c93c6536f0819ccf10a30c
-
SHA256
7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878
-
SHA512
0f7c2d60c429676dcf6db7ddcb7ed17ade0aa229494118de921d67f6b772bcfe3390b66af80abf7ea476a603093ce74d8e1ae72dbc093d002d6e8de4d7873219
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaN:174g2LDeiPDImOkx2LIaN
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe 4548 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4548 rundll32.exe Token: SeTcbPrivilege 4548 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2728 wrote to memory of 4548 2728 rundll32.exe 83 PID 2728 wrote to memory of 4548 2728 rundll32.exe 83 PID 2728 wrote to memory of 4548 2728 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ff68c54e371ab8c0afb44eea1dd9161bc6c546408d5290f165c745a1fb1f878.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548
-