Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17/04/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll
Resource
win10v2004-20240412-en
General
-
Target
d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll
-
Size
397KB
-
MD5
e7fba96ab6522a0cbcc89b3340dc0146
-
SHA1
4ee9816f580572897e4abe2050d86807004c3017
-
SHA256
d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f
-
SHA512
6bb8b6c5affa6a0409f636fa8611e25e562a2a0f654d2dad0dd8f95e6469a72f441d1ceb7a0198c6bf65280b4fdb555a6d0fc8678efc650ebf1c609c7dcfb0ac
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOal:174g2LDeiPDImOkx2LIal
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1976 rundll32.exe 1976 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1976 rundll32.exe Token: SeTcbPrivilege 1976 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1976 1688 rundll32.exe 28 PID 1688 wrote to memory of 1976 1688 rundll32.exe 28 PID 1688 wrote to memory of 1976 1688 rundll32.exe 28 PID 1688 wrote to memory of 1976 1688 rundll32.exe 28 PID 1688 wrote to memory of 1976 1688 rundll32.exe 28 PID 1688 wrote to memory of 1976 1688 rundll32.exe 28 PID 1688 wrote to memory of 1976 1688 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d2c5e0226eea0c185b8f9808124be5972536ff448be2d58845b565f6e33ca67f.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976
-