Analysis
-
max time kernel
140s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 01:43
Behavioral task
behavioral1
Sample
ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf.dll
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf.dll
Resource
win10v2004-20240508-en
5 signatures
150 seconds
General
-
Target
ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf.dll
-
Size
76KB
-
MD5
73ef561e21958e75bce57d7ff9a9ba32
-
SHA1
f332895e7ee6ab121487922fd7ffe3f6f6916ad0
-
SHA256
ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf
-
SHA512
934721fbfd7fcff8f6189027bfd8d47eab3114e3dc30c0ee18c20a8864207034c0beffbbbaa7b8a3a740885ac0ed7a915284dda0dcd4470ce35bba029ca2fa85
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZE+D:c8y93KQjy7G55riF1cMo031
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/3024-0-0x0000000010000000-0x0000000010030000-memory.dmp UPX behavioral2/memory/3024-1-0x0000000010000000-0x0000000010030000-memory.dmp UPX -
resource yara_rule behavioral2/memory/3024-0-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/3024-1-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3024 rundll32.exe 3024 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3024 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 940 wrote to memory of 3024 940 rundll32.exe 82 PID 940 wrote to memory of 3024 940 rundll32.exe 82 PID 940 wrote to memory of 3024 940 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ab4efbdce824f713d14298e2ed11f54d6ea3727c9c2b330719a21374e2002fdf.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024
-