f87237859e6849d770c327ae300cdfbff8b8f9193e8ace2f739f8629a087b7f3

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 23:10

Target

101.34.205.247:8080/cs/parfait.dll
Size

3.6MB
MD5

9fe49a178cd8ac85b39d9d690e1ab1e2
SHA1

ee8d92680aa07b68ce543c5543f231bb07780772
SHA256

2074d782d41071f6a232c4556c59d076f5bf3d5a83885cf61d1f2536130f0870
SHA512

0a13b50ae13de292467b8ca43fe4cf894706ae6e582d45884e5bf0c176de00887fbadea50f91eceacd19a5e8f60f43aec3d834f5387966614a42123cb87523d0
SSDEEP

49152:ZP5Z00mp+oBjG+ZMS9o5z8H01lzjN5Et+/veZ+NI:Fw+kKI9Y3LEt8Wx

Score

7^/10

Deletes itself 1 IoCs

pid	Process
5032	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5032	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5032	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5032	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	rundll32.exe
Token: SeDebugPrivilege	5032	rundll32.exe

memory/5032-0-0x00007FFD8DBD0000-0x00007FFD8DFF5000-memory.dmp

Filesize
4.1MB

Download
memory/5032-1-0x00007FFD8DBD0000-0x00007FFD8DFF5000-memory.dmp

Filesize
4.1MB

Download
memory/5032-2-0x00007FFD8DBD0000-0x00007FFD8DFF5000-memory.dmp

Filesize
4.1MB

Download
memory/5032-3-0x00007FFD8DBD0000-0x00007FFD8DFF5000-memory.dmp

Filesize
4.1MB

Download
memory/5032-4-0x00007FFD8DBD0000-0x00007FFD8DFF5000-memory.dmp

Filesize
4.1MB

Download
memory/5032-5-0x00007FFD8DBD0000-0x00007FFD8DFF5000-memory.dmp

Filesize
4.1MB

Download
memory/5032-7-0x00007FFD8DAA0000-0x00007FFD8DBCE000-memory.dmp

Filesize
1.2MB

Download
memory/5032-6-0x00007FFD8DBD0000-0x00007FFD8DFF5000-memory.dmp

Filesize
4.1MB

Download