f87237859e6849d770c327ae300cdfbff8b8f9193e8ace2f739f8629a087b7f3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 23:10

Target

101.34.205.247:8080/parfait.dll
Size

3.6MB
MD5

84d2054d713e43901f90f0f852a8dc75
SHA1

638a4affdec61a3327e8fbe0fd9d7f46253809e0
SHA256

0fef509b48adbcd517d71debf0b26f546db56db57d4ef62f386be839418a68a0
SHA512

06a07a9209dc0ec4ab4b6af05cad89bc167aabc359356a1dca8eee5420b96605e7bc031ef29351f79c18fc3829d1151dd7bc462274ad172a30fac7c392cf8ccd
SSDEEP

49152:sP5Z00mp+oBjG+ZMS9o5z8Hd1hpjE5Etw/vegnNI:Uw+kKI9Y+cEtGWt

Score

7^/10

Deletes itself 1 IoCs

pid	Process
960	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
960	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
960	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
960	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	rundll32.exe
Token: SeDebugPrivilege	960	rundll32.exe

memory/960-0-0x00007FFB42FF0000-0x00007FFB43415000-memory.dmp

Filesize
4.1MB

Download
memory/960-1-0x00007FFB42FF0000-0x00007FFB43415000-memory.dmp

Filesize
4.1MB

Download
memory/960-2-0x00007FFB42FF0000-0x00007FFB43415000-memory.dmp

Filesize
4.1MB

Download
memory/960-3-0x00007FFB42FF0000-0x00007FFB43415000-memory.dmp

Filesize
4.1MB

Download
memory/960-4-0x00007FFB42FF0000-0x00007FFB43415000-memory.dmp

Filesize
4.1MB

Download
memory/960-5-0x00007FFB42FF0000-0x00007FFB43415000-memory.dmp

Filesize
4.1MB

Download
memory/960-6-0x00007FFB42FF0000-0x00007FFB43415000-memory.dmp

Filesize
4.1MB

Download