Analysis
-
max time kernel
97s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 02:43
Behavioral task
behavioral1
Sample
de583765444be446baeca4ccd8ee3810c41cd7153f5d5b94ab10e65edc143b3d.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
de583765444be446baeca4ccd8ee3810c41cd7153f5d5b94ab10e65edc143b3d.dll
Resource
win10v2004-20240508-en
General
-
Target
de583765444be446baeca4ccd8ee3810c41cd7153f5d5b94ab10e65edc143b3d.dll
-
Size
984KB
-
MD5
8b47ffc81cbf3b1ab3c4b291489b1a38
-
SHA1
47dd9368d3849f7c0e14873de001f9609f6b75dd
-
SHA256
de583765444be446baeca4ccd8ee3810c41cd7153f5d5b94ab10e65edc143b3d
-
SHA512
529bb98c8de389f29c407723d11c580f8b10b2bc7138b1e5d2aaff072f1287da930a603eee00ccd9f7643ddcc7e9121043b27c43c200a0a6a4cfd251abca25f2
-
SSDEEP
24576:sgvs07R4vjj0aYWQhGvAiGi772dZYOpBF:swF7N0MTdZYO
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4572-0-0x00000000748A0000-0x0000000074B29000-memory.dmp upx behavioral2/memory/4572-1-0x00000000748A0000-0x0000000074B29000-memory.dmp upx behavioral2/memory/4572-2-0x00000000748A0000-0x0000000074B29000-memory.dmp upx -
Processes:
rundll32.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\rundll32.exe = "11000" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
rundll32.exepid process 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe 4572 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 652 wrote to memory of 4572 652 rundll32.exe rundll32.exe PID 652 wrote to memory of 4572 652 rundll32.exe rundll32.exe PID 652 wrote to memory of 4572 652 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de583765444be446baeca4ccd8ee3810c41cd7153f5d5b94ab10e65edc143b3d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de583765444be446baeca4ccd8ee3810c41cd7153f5d5b94ab10e65edc143b3d.dll,#12⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:4572