d3b373783bf200ce4fded5f5ab1364c051bd8f5e1f3feda64b4b86115c175cfb

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 15:01

Target

d3b373783bf200ce4fded5f5ab1364c051bd8f5e1f3feda64b4b86115c175cfb.dll
Size

33KB
MD5

709ea79521aeff95f0ceabe89c80c332
SHA1

305a7921f6944f5b307a2978c90d329349b22105
SHA256

d3b373783bf200ce4fded5f5ab1364c051bd8f5e1f3feda64b4b86115c175cfb
SHA512

4c8a285860da735209dc0f2ae4061cf48a9c2e7a329774e9eff4d34523fc36bd175308b5ec8d2a8de576346b0f0415ba45f43fc983be5bf161bc70133ee93a0b
SSDEEP

768:m+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:m+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3b373783bf200ce4fded5f5ab1364c051bd8f5e1f3feda64b4b86115c175cfb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d3b373783bf200ce4fded5f5ab1364c051bd8f5e1f3feda64b4b86115c175cfb.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1972

memory/1972-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x00000000000C0000-0x00000000000CE000-memory.dmp

Filesize
56KB

Download