Analysis
-
max time kernel
147s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 11:59
Behavioral task
behavioral1
Sample
e19d96622df7097563cba1926dacbc65.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
e19d96622df7097563cba1926dacbc65.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
e19d96622df7097563cba1926dacbc65.dll
-
Size
64KB
-
MD5
e19d96622df7097563cba1926dacbc65
-
SHA1
7ee000e2df41c17e28f5fffac7c7cd5b8cb22e65
-
SHA256
4d55141f6c81e1a847deac2f10586a60af5314e3dfcb3ca2d5794d996e3ecd04
-
SHA512
397847b7e9a9cc8eadbfb462c0c6d3a824a0a348bff25559186c1efa65c89b7a539759aeb0f1ba517ad934d5cacf4d403e9063a9c75a0c4cc3aebdf0affe8924
-
SSDEEP
1536:lOzDfThCY9pMfJaoZohuv/k8gC2srIe4P:l+lv9pFsKa2AIe4P
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1932-0-0x0000000010000000-0x000000001002E000-memory.dmp vmprotect behavioral1/memory/1932-1-0x0000000010000000-0x000000001002E000-memory.dmp vmprotect behavioral1/memory/1932-9-0x0000000010000000-0x000000001002E000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe Token: SeDebugPrivilege 1932 rundll32.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 1740 wrote to memory of 1932 1740 rundll32.exe 28 PID 1740 wrote to memory of 1932 1740 rundll32.exe 28 PID 1740 wrote to memory of 1932 1740 rundll32.exe 28 PID 1740 wrote to memory of 1932 1740 rundll32.exe 28 PID 1740 wrote to memory of 1932 1740 rundll32.exe 28 PID 1740 wrote to memory of 1932 1740 rundll32.exe 28 PID 1740 wrote to memory of 1932 1740 rundll32.exe 28 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7 PID 1932 wrote to memory of 480 1932 rundll32.exe 7
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e19d96622df7097563cba1926dacbc65.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e19d96622df7097563cba1926dacbc65.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
-