Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 20:14
Static task
static1
Behavioral task
behavioral1
Sample
f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c.dll
Resource
win10v2004-20240226-en
General
-
Target
f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c.dll
-
Size
397KB
-
MD5
7f1cbc650e90e3d164ed00121031bd16
-
SHA1
c4b9f95231141f251cf7519329d643c13e622a2e
-
SHA256
f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c
-
SHA512
4b8efcb16b88f32c375006f538e8a77f026d2a0f645acfbc4af9ee65a8227b4eb6120ecfd908345085b0f06be7d288ed06ee9a72bd787c7b5829816be79c6529
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOai:174g2LDeiPDImOkx2LIai
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 320 rundll32.exe 320 rundll32.exe 320 rundll32.exe 320 rundll32.exe 320 rundll32.exe 320 rundll32.exe 320 rundll32.exe 320 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 320 rundll32.exe Token: SeTcbPrivilege 320 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4216 wrote to memory of 320 4216 rundll32.exe 88 PID 4216 wrote to memory of 320 4216 rundll32.exe 88 PID 4216 wrote to memory of 320 4216 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f67cf8615c3b1540b7ac51d078d526627be58773cd25b6fc6b1cc6b30390323c.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:320
-