342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3

max time kernel
66s
max time network
64s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 15:44

Sharing

Target

dl2.exe
Size

849KB
MD5

c2055b7fbaa041d9f68b9d5df9b45edd
SHA1

e4bd443bd4ce9029290dcd4bb47cb1a01f3b1b06
SHA256

342f04c4720590c40d24078d46d9b19d8175565f0af460598171d58f5ffc48f3
SHA512

18905b75938b8af9468b1aa3ffbae796a139c2762e623aa6ffb9ec2b293dd04aa1f90d1ed5a7dbda7853795a3688e368121a134c7f63e527a8e5e7679301a1dc
SSDEEP

12288:A3RY3yNqMRTF4q2rxHn2ot/81xpNQyjUXlmoe7ufjHAtjXD7r2:A3RY3R24q+xn/8Xp2yOl5fzQ/2

Score

1^/10

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

2016 taskmgr.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskmgr.exe

description pid process

Token: SeDebugPrivilege 2016 taskmgr.exe

description	pid	process
Token: SeDebugPrivilege	2016	taskmgr.exe

Suspicious use of FindShellTrayWindow 42 IoCs

Processes:

taskmgr.exe

Suspicious use of SendNotifyMessage 42 IoCs

Processes:

taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

dl2.exedl2.exe

pid process

1312 dl2.exe
2508 dl2.exe

pid	process
1312	dl2.exe
2508	dl2.exe

C:\Users\Admin\AppData\Local\Temp\dl2.exe
"C:\Users\Admin\AppData\Local\Temp\dl2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1312

C:\Users\Admin\AppData\Local\Temp\dl2.exe
C:\Users\Admin\AppData\Local\Temp\dl2.exe {5F593D2A-713E-410F-A727-79C307851412}
1⤵
- Suspicious use of SetWindowsHookEx
PID:2508

memory/1312-1-0x00000000001F0000-0x0000000000220000-memory.dmp

Filesize
192KB

Download
memory/1312-5-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/1312-18-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/1312-22-0x0000000000270000-0x0000000000370000-memory.dmp

Filesize
1024KB

Download
memory/2016-19-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2016-20-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2016-21-0x0000000001D90000-0x0000000001D91000-memory.dmp

Filesize
4KB

Download
memory/2508-10-0x0000000001E50000-0x0000000001E80000-memory.dmp

Filesize
192KB

Download
memory/2508-12-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download