61261edede7203caeba605abb06723425290a109db8ed13e3ca9b558e2078f62

Analysis

max time kernel
92s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 13:29

Target

a3e73d2687faa3241f85df988564af54.dll
Size

11KB
MD5

a3e73d2687faa3241f85df988564af54
SHA1

959bd5750000d53698d364af64f4bd0db131a979
SHA256

61261edede7203caeba605abb06723425290a109db8ed13e3ca9b558e2078f62
SHA512

78b4b78b7bb50666642a15fa2b346cbf26001176d145874d2b5f5805cfcd26467d758101a950ed83f2adea437f38a539edde321e789460477900fb791dbee251
SSDEEP

192:1cvnHE6zt316rqHejoZxbeNsMFTgvPrATnvg56MiZTy8kgUw9B:+fBt3ZLZxbeNx8vPrQvgwMsTyD6

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sperls.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sperls.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2960	4380	rundll32.exe	20
PID 4380 wrote to memory of 2960	4380	rundll32.exe	20
PID 4380 wrote to memory of 2960	4380	rundll32.exe	20
PID 2960 wrote to memory of 3448	2960	rundll32.exe	42

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3e73d2687faa3241f85df988564af54.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a3e73d2687faa3241f85df988564af54.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2960

memory/2960-0-0x000000000F000000-0x000000000F015000-memory.dmp

Filesize
84KB

Download