b649f12b1dcfb9835ba6ac89e9ea54cd4dcfe17d5f22ca8005a610e1b80e9fd8

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 19:19

Target

b649f12b1dcfb9835ba6ac89e9ea54cd4dcfe17d5f22ca8005a610e1b80e9fd8.dll
Size

33KB
MD5

60180c3a32cb2677f1d151bd90d45b8f
SHA1

d4d6d6067744cea345002d6f80ddf5ee66e0da00
SHA256

b649f12b1dcfb9835ba6ac89e9ea54cd4dcfe17d5f22ca8005a610e1b80e9fd8
SHA512

1182bcf098a70502e58b66fd2ca36755866000191169528cf0fc7203116c7d6586fa2cfb490b63fcf7338a9cfd981679823ce0844e7223e4cbf5d6832598d6e5
SSDEEP

768:r+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:r+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2028	1056	rundll32.exe	26
PID 1056 wrote to memory of 2028	1056	rundll32.exe	26
PID 1056 wrote to memory of 2028	1056	rundll32.exe	26
PID 1056 wrote to memory of 2028	1056	rundll32.exe	26
PID 1056 wrote to memory of 2028	1056	rundll32.exe	26
PID 1056 wrote to memory of 2028	1056	rundll32.exe	26
PID 1056 wrote to memory of 2028	1056	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b649f12b1dcfb9835ba6ac89e9ea54cd4dcfe17d5f22ca8005a610e1b80e9fd8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b649f12b1dcfb9835ba6ac89e9ea54cd4dcfe17d5f22ca8005a610e1b80e9fd8.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2028

memory/2028-55-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2028-56-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download