e37266f3523c8465e175626167efcf84fa54ac2e7ec726e486eb7350aac9b12e

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 21:41

Target

e37266f3523c8465e175626167efcf84fa54ac2e7ec726e486eb7350aac9b12e.dll
Size

33KB
MD5

9020ec0fee9147746ce93b2c9cfa7840
SHA1

b6fd6296ead2c85c7fe524914ca3fcce7efd1acf
SHA256

e37266f3523c8465e175626167efcf84fa54ac2e7ec726e486eb7350aac9b12e
SHA512

2b46b1767e1582aaeb649e701088ca7013e6e6f1457c2a53f26784ba7bab9afd74d3c28cb480960cb14c64f8e02ccecb4976cac84b66b8c805ac9e13913b88eb
SSDEEP

768:i+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEof:i+av6qZ4QxpP0AtNfRJ5BHxYm

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27
PID 1720 wrote to memory of 1300	1720	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e37266f3523c8465e175626167efcf84fa54ac2e7ec726e486eb7350aac9b12e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e37266f3523c8465e175626167efcf84fa54ac2e7ec726e486eb7350aac9b12e.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1300

memory/1300-54-0x0000000000000000-mapping.dmp

Download
memory/1300-55-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1300-56-0x00000000000F0000-0x00000000000FE000-memory.dmp

Filesize
56KB

Download