Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
-
submitted
07-02-2025 18:41
General
-
Target
cda9bee14d4527bde8d3c342f3ca09ac7ec3789bba9cd8583fb5f1d409256610.dll
-
Size
2.1MB
-
MD5
dc8d2d203a667cd50238a0da1647893a
-
SHA1
529561f59788997e8f628f43dc5298219ef07685
-
SHA256
cda9bee14d4527bde8d3c342f3ca09ac7ec3789bba9cd8583fb5f1d409256610
-
SHA512
5f348db8a06897d42dbffd075e07e23a6e622e30f38dc6b4f8a9d734865a354ac1225c85c448d2a9ea2d7c5e803d181b8a96283d48c75af601de414a12b4d5d3
-
SSDEEP
49152:dzrSA6JHcSf80R0xygstpXbh2M9Zx/pUeKltwHjUckPoFAC:dzkJB80CulvUemyUTP+AC
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cda9bee14d4527bde8d3c342f3ca09ac7ec3789bba9cd8583fb5f1d409256610.dll,#11⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken