8c83975a37abdf726c0752d853224f594ab39b9fa167103fcfb7e797d027a0dc

Analysis

max time kernel
20s
max time network
24s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 08:28

Reason

Machine shutdown

Target

8c83975a37abdf726c0752d853224f594ab39b9fa167103fcfb7e797d027a0dc.dll
Size

818KB
MD5

ece61d641ac1fc20f3a2c4d141e0badf
SHA1

19c90e019941d0deeb6254d0ab9204a184adce7e
SHA256

8c83975a37abdf726c0752d853224f594ab39b9fa167103fcfb7e797d027a0dc
SHA512

b9e8db083d125101d9687ba70fb58e77204bc9fe90c7501c30a9300e74427013ddfe23341ba55c1d9db7117ac16009351154edd6a553e7dc23a6e46c2abf780c
SSDEEP

12288:5YOOgW7LTpcic8Fhuj+BY7q7YwFL9kWsL/IWbGPsjAqbYRufkH422vZZDf:Ohuj+BY7q7YwFL9kWsjIWbGAY/uvZZ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

shutdown.exe

description pid process

Token: SeShutdownPrivilege 1616 shutdown.exe
Token: SeRemoteShutdownPrivilege 1616 shutdown.exe

description	pid	process
Token: SeShutdownPrivilege	1616	shutdown.exe
Token: SeRemoteShutdownPrivilege	1616	shutdown.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.execmd.exe

description	pid	process	target process
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 992 wrote to memory of 928	992	rundll32.exe	rundll32.exe
PID 928 wrote to memory of 276	928	rundll32.exe	cmd.exe
PID 928 wrote to memory of 276	928	rundll32.exe	cmd.exe
PID 928 wrote to memory of 276	928	rundll32.exe	cmd.exe
PID 928 wrote to memory of 276	928	rundll32.exe	cmd.exe
PID 276 wrote to memory of 1616	276	cmd.exe	shutdown.exe
PID 276 wrote to memory of 1616	276	cmd.exe	shutdown.exe
PID 276 wrote to memory of 1616	276	cmd.exe	shutdown.exe
PID 276 wrote to memory of 1616	276	cmd.exe	shutdown.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c83975a37abdf726c0752d853224f594ab39b9fa167103fcfb7e797d027a0dc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c83975a37abdf726c0752d853224f594ab39b9fa167103fcfb7e797d027a0dc.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Shutdown -r -f -t 0
3⤵
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\SysWOW64\shutdown.exe
Shutdown -r -f -t 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616

memory/276-56-0x0000000000000000-mapping.dmp

Download
memory/928-54-0x0000000000000000-mapping.dmp

Download
memory/928-55-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download
memory/1504-58-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/1616-57-0x0000000000000000-mapping.dmp

Download