Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 11:59
Behavioral task
behavioral1
Sample
e19d96622df7097563cba1926dacbc65.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
e19d96622df7097563cba1926dacbc65.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
e19d96622df7097563cba1926dacbc65.dll
-
Size
64KB
-
MD5
e19d96622df7097563cba1926dacbc65
-
SHA1
7ee000e2df41c17e28f5fffac7c7cd5b8cb22e65
-
SHA256
4d55141f6c81e1a847deac2f10586a60af5314e3dfcb3ca2d5794d996e3ecd04
-
SHA512
397847b7e9a9cc8eadbfb462c0c6d3a824a0a348bff25559186c1efa65c89b7a539759aeb0f1ba517ad934d5cacf4d403e9063a9c75a0c4cc3aebdf0affe8924
-
SSDEEP
1536:lOzDfThCY9pMfJaoZohuv/k8gC2srIe4P:l+lv9pFsKa2AIe4P
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2484-0-0x0000000010000000-0x000000001002E000-memory.dmp vmprotect behavioral2/memory/2484-1-0x0000000010000000-0x000000001002E000-memory.dmp vmprotect behavioral2/memory/2484-2-0x0000000010000000-0x000000001002E000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe 2484 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe Token: SeDebugPrivilege 2484 rundll32.exe -
Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 4852 wrote to memory of 2484 4852 rundll32.exe 89 PID 4852 wrote to memory of 2484 4852 rundll32.exe 89 PID 4852 wrote to memory of 2484 4852 rundll32.exe 89 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7 PID 2484 wrote to memory of 668 2484 rundll32.exe 7
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e19d96622df7097563cba1926dacbc65.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e19d96622df7097563cba1926dacbc65.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
-