1a99bc9357affa392b3f44d35432277e3ec4f648d305f8cea13fe7efa07d3892

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 15:54

Target

1a99bc9357affa392b3f44d35432277e3ec4f648d305f8cea13fe7efa07d3892.dll
Size

33KB
MD5

6cf19418d849e8cfd79828e2b35d9de1
SHA1

61c753f2da293eeaef15584ec14ff1df08be3450
SHA256

1a99bc9357affa392b3f44d35432277e3ec4f648d305f8cea13fe7efa07d3892
SHA512

f1a3cdc35138eee46595c949dde0e73846597613148ddfd76b58ec06c30cf65308e038164ba9e14410b4cc2ce92dc554a55fc3b3e12924576af3bc185982f9c0
SSDEEP

768:f+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:f+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	816	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27
PID 1464 wrote to memory of 816	1464	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a99bc9357affa392b3f44d35432277e3ec4f648d305f8cea13fe7efa07d3892.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1a99bc9357affa392b3f44d35432277e3ec4f648d305f8cea13fe7efa07d3892.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:816

memory/816-55-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/816-56-0x00000000000B0000-0x00000000000BE000-memory.dmp

Filesize
56KB

Download