2716e72ec123a824d9f54565db8609d9c7f5c31c729b7cf8370598195cdc7f01

Analysis

Target

2716e72ec123a824d9f54565db8609d9c7f5c31c729b7cf8370598195cdc7f01.dll
Size

164KB
MD5

960a5736981a42f0c16106da79faffa7
SHA1

b9026bada9a7ae8835799a0144eb38fe37a70981
SHA256

2716e72ec123a824d9f54565db8609d9c7f5c31c729b7cf8370598195cdc7f01
SHA512

9c70cdbf105a4551c53c981a4f84ce0b111e4b0de26ff97ecae83c4e69136d0c8a84bc384c3154ab70b4770e7050bed6044f8f5d11cd9064af089466667ae714

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

msiexec.exe

flow pid process

17 3292 msiexec.exe
21 3292 msiexec.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 4720 set thread context of 3292 4720 rundll32.exe msiexec.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeSecurityPrivilege 3292 msiexec.exe
Token: SeSecurityPrivilege 3292 msiexec.exe

flow	pid	process
17	3292	msiexec.exe
21	3292	msiexec.exe

description	pid	process	target process
PID 4720 set thread context of 3292	4720	rundll32.exe	msiexec.exe

description	pid	process
Token: SeSecurityPrivilege	3292	msiexec.exe
Token: SeSecurityPrivilege	3292	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 4704 wrote to memory of 4720	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 4720	4704	rundll32.exe	rundll32.exe
PID 4704 wrote to memory of 4720	4704	rundll32.exe	rundll32.exe
PID 4720 wrote to memory of 3292	4720	rundll32.exe	msiexec.exe
PID 4720 wrote to memory of 3292	4720	rundll32.exe	msiexec.exe
PID 4720 wrote to memory of 3292	4720	rundll32.exe	msiexec.exe
PID 4720 wrote to memory of 3292	4720	rundll32.exe	msiexec.exe
PID 4720 wrote to memory of 3292	4720	rundll32.exe	msiexec.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2716e72ec123a824d9f54565db8609d9c7f5c31c729b7cf8370598195cdc7f01.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4704

memory/3292-3-0x0000000000000000-mapping.dmp

Download
memory/3292-4-0x0000000002ED0000-0x0000000002EF9000-memory.dmp

Filesize
164KB

Download
memory/4720-2-0x0000000000000000-mapping.dmp

Download