ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd | Triage

Analysis

max time kernel
145s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
28-04-2024 10:49

Sharing

Report Analysis Logs

General

Target

setuphlpr.dll
Size

264KB
MD5

5b8659339fb6f998f25f3d7055b90a8c
SHA1

f28ec774744fbd6e2fc9f594bd4d31ef2adb8276
SHA256

c9bfcea372292fbd29f5a5f6cb51f97143d80e036133830fcb74f0994de51050
SHA512

37515fee58d2b2df3f3e9d270ec9d4f83f49333411a41c5a7d0514a5745c747ea5d79de2bffc543a2d54124ac49476805d99c18dc9ec0550be538eb9ecac3d99
SSDEEP

6144:yHLpnU4NBjqLzHNDJzB+cjoLq+OAMGsGSU:yHLpU4q9+cjo2+FL

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 2748 rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1684 wrote to memory of 2748	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2748	1684	rundll32.exe	rundll32.exe
PID 1684 wrote to memory of 2748	1684	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\setuphlpr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\setuphlpr.dll,#1
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads