6dbeebffd9de2d1c6c10c7d2bbc221dccf92b8ee4a203f5761d1343e34436a61

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 09:45

Target

츨11.27ɫ/츨11.27.dll
Size

372KB
MD5

6a6fcfdc2ad43d19e3299918a8845e84
SHA1

a66030d34e3357e00181241d48e8302a0a4e2098
SHA256

37e79983cde9c2f70fd73077dd7fafb944ec053f87976c6b33821b67001f0313
SHA512

495fb60dec4a65f7de72893049f46529f70bbb0eb852feab6c75f9998453413c1dc78b6779d3c55e9510ca40457c09b812b414edf4188e136f6f4ffd5c20b2e8
SSDEEP

6144:uz2R08dAbIs+orwFxCo0kNYXXGmo9TsrnpWh5G/ho0q4X/ieoNw4guSf629uCKPT:rRmIsgDOqOAyRGCVt/omrMc034jyXz02

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1100 rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1100	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1816 wrote to memory of 1100	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1100	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1100	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1100	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1100	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1100	1816	rundll32.exe	rundll32.exe
PID 1816 wrote to memory of 1100	1816	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\츨11.27ɫ\츨11.27.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1100

memory/1100-54-0x0000000000000000-mapping.dmp

Download
memory/1100-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download