da62a88ad49057a896bed83c4c9dbce22bd20daf05ce9c323f154d4a298a0d2f

Analysis

max time kernel
40s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 15:54

Target

da62a88ad49057a896bed83c4c9dbce22bd20daf05ce9c323f154d4a298a0d2f.dll
Size

33KB
MD5

07ce0ed38400bf2bd41859f69600383a
SHA1

9fcda664eb4d61337668b9ff94e3fd4cbcd1e553
SHA256

da62a88ad49057a896bed83c4c9dbce22bd20daf05ce9c323f154d4a298a0d2f
SHA512

6ff4341d59e481c81ca4c33ad1acf084182bc5b7c25491daa50758780f63f50c36bd27d96cd5694e612bb8494d6f3b741d49029db3ea0abbd4ff12aa316ebc36
SSDEEP

768:R+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:R+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1172	1692	rundll32.exe	27
PID 1692 wrote to memory of 1172	1692	rundll32.exe	27
PID 1692 wrote to memory of 1172	1692	rundll32.exe	27
PID 1692 wrote to memory of 1172	1692	rundll32.exe	27
PID 1692 wrote to memory of 1172	1692	rundll32.exe	27
PID 1692 wrote to memory of 1172	1692	rundll32.exe	27
PID 1692 wrote to memory of 1172	1692	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\da62a88ad49057a896bed83c4c9dbce22bd20daf05ce9c323f154d4a298a0d2f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\da62a88ad49057a896bed83c4c9dbce22bd20daf05ce9c323f154d4a298a0d2f.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1172

memory/1172-55-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1172-56-0x0000000000120000-0x000000000012E000-memory.dmp

Filesize
56KB

Download