Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 10:08
Static task
static1
Behavioral task
behavioral1
Sample
98c36757fac8a03d769c01b475ccbf0f11314fbcd28198f40d970cf46100b5b8.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
98c36757fac8a03d769c01b475ccbf0f11314fbcd28198f40d970cf46100b5b8.dll
Resource
win10v2004-20240412-en
General
-
Target
98c36757fac8a03d769c01b475ccbf0f11314fbcd28198f40d970cf46100b5b8.dll
-
Size
397KB
-
MD5
e622aa55e30bebe872bfd8c67f83b8c1
-
SHA1
e17275aba531564b6dff1d4ce618ecd7f8684b4e
-
SHA256
98c36757fac8a03d769c01b475ccbf0f11314fbcd28198f40d970cf46100b5b8
-
SHA512
f7c2df8715c3869e581ddf28214dbf351f5469638ab6a75aaaa4c010db3bfe4e979f2f674c27a8c2eb84d746817893191ff1521422c785ce5eafa6a635ee1810
-
SSDEEP
6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa/:174g2LDeiPDImOkx2LIa/
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4896 rundll32.exe 4896 rundll32.exe 4896 rundll32.exe 4896 rundll32.exe 4896 rundll32.exe 4896 rundll32.exe 4896 rundll32.exe 4896 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4896 rundll32.exe Token: SeTcbPrivilege 4896 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1788 wrote to memory of 4896 1788 rundll32.exe 83 PID 1788 wrote to memory of 4896 1788 rundll32.exe 83 PID 1788 wrote to memory of 4896 1788 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\98c36757fac8a03d769c01b475ccbf0f11314fbcd28198f40d970cf46100b5b8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\98c36757fac8a03d769c01b475ccbf0f11314fbcd28198f40d970cf46100b5b8.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896
-