Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 01:00
Behavioral task
behavioral1
Sample
00bf0bd9873539b2b17493d43fcf9aa0.dll
Resource
win7-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
00bf0bd9873539b2b17493d43fcf9aa0.dll
Resource
win10v2004-20240426-en
5 signatures
150 seconds
General
-
Target
00bf0bd9873539b2b17493d43fcf9aa0.dll
-
Size
76KB
-
MD5
00bf0bd9873539b2b17493d43fcf9aa0
-
SHA1
0e811c7a93dc08e0e1bac1f19ca4e6efdfab2284
-
SHA256
6e8ca33521b1327e2e80dd62f89c13ae5635bd3c77b117414be1b1073872bad1
-
SHA512
d7b6d1c06d1e79dd1521a14c9daef0b964b9d90e655a3f5d831834451706799742612904b8ebe88a92be88097a5b7427dab41bd9da4c7d4337a25deceb9268fd
-
SSDEEP
1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZCR2+i:c8y93KQjy7G55riF1cMo03gR2+i
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2872-2-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2928 2872 WerFault.exe 28 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2872 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2872 2164 rundll32.exe 28 PID 2164 wrote to memory of 2872 2164 rundll32.exe 28 PID 2164 wrote to memory of 2872 2164 rundll32.exe 28 PID 2164 wrote to memory of 2872 2164 rundll32.exe 28 PID 2164 wrote to memory of 2872 2164 rundll32.exe 28 PID 2164 wrote to memory of 2872 2164 rundll32.exe 28 PID 2164 wrote to memory of 2872 2164 rundll32.exe 28 PID 2872 wrote to memory of 2928 2872 rundll32.exe 29 PID 2872 wrote to memory of 2928 2872 rundll32.exe 29 PID 2872 wrote to memory of 2928 2872 rundll32.exe 29 PID 2872 wrote to memory of 2928 2872 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00bf0bd9873539b2b17493d43fcf9aa0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\00bf0bd9873539b2b17493d43fcf9aa0.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 2763⤵
- Program crash
PID:2928
-
-