ec4a958ab73fa233b4bb5cbaf68ea3486384997d53740bfa9c3307ce150a59dd | Triage

Analysis

max time kernel
145s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
28/04/2024, 10:49

Sharing

Report Analysis Logs

General

Target

setuphlpr.dll
Size

264KB
MD5

5b8659339fb6f998f25f3d7055b90a8c
SHA1

f28ec774744fbd6e2fc9f594bd4d31ef2adb8276
SHA256

c9bfcea372292fbd29f5a5f6cb51f97143d80e036133830fcb74f0994de51050
SHA512

37515fee58d2b2df3f3e9d270ec9d4f83f49333411a41c5a7d0514a5745c747ea5d79de2bffc543a2d54124ac49476805d99c18dc9ec0550be538eb9ecac3d99
SSDEEP

6144:yHLpnU4NBjqLzHNDJzB+cjoLq+OAMGsGSU:yHLpU4q9+cjo2+FL

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2748	1684	rundll32.exe	80
PID 1684 wrote to memory of 2748	1684	rundll32.exe	80
PID 1684 wrote to memory of 2748	1684	rundll32.exe	80

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\setuphlpr.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\setuphlpr.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads