7cfa50197b985a73d791e747f381fa35cc8cb3907447eac03998e3929a7153b8

Analysis

Target

artifact-7cfa50197b985a73d791e747f381fa35cc8cb3907447eac03998e3929a7153b8.dll
Size

372KB
MD5

10a80344b002ff386d14dabe7850f012
SHA1

cabe72e14348b41003187aa8e328db999f29f682
SHA256

7cfa50197b985a73d791e747f381fa35cc8cb3907447eac03998e3929a7153b8
SHA512

8e6b23d03532b16fab5a7801ce36d25eca3258267daa1221d99c36ce3df8dfe59baf7297b8a93584655e5090369eb2601d9e793b62cc0a1b30e170151f5a1e94

Score

8^/10

Blocklisted process makes network request 5 IoCs

Processes:

msiexec.exe

flow pid process

14 1248 msiexec.exe
16 1248 msiexec.exe
18 1248 msiexec.exe
20 1248 msiexec.exe
22 1248 msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 684 set thread context of 1248 684 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 1248 msiexec.exe
Token: SeSecurityPrivilege 1248 msiexec.exe

description	pid	process	target process
PID 684 set thread context of 1248	684	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	1248	msiexec.exe
Token: SeSecurityPrivilege	1248	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 636 wrote to memory of 684	636	rundll32.exe	rundll32.exe
PID 636 wrote to memory of 684	636	rundll32.exe	rundll32.exe
PID 636 wrote to memory of 684	636	rundll32.exe	rundll32.exe
PID 684 wrote to memory of 1248	684	rundll32.exe	msiexec.exe
PID 684 wrote to memory of 1248	684	rundll32.exe	msiexec.exe
PID 684 wrote to memory of 1248	684	rundll32.exe	msiexec.exe
PID 684 wrote to memory of 1248	684	rundll32.exe	msiexec.exe
PID 684 wrote to memory of 1248	684	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\artifact-7cfa50197b985a73d791e747f381fa35cc8cb3907447eac03998e3929a7153b8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:636

memory/684-2-0x0000000000000000-mapping.dmp

Download
memory/684-3-0x0000000074360000-0x0000000074389000-memory.dmp

Filesize
164KB

Download
memory/684-4-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/1248-5-0x0000000000000000-mapping.dmp

Download
memory/1248-6-0x0000000001200000-0x0000000001229000-memory.dmp

Filesize
164KB

Download