580799f4eaaa31f433b1ea1991818eec2e00e653cc0030e46ed93a43280ece9f

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 09:20

Target

580799f4eaaa31f433b1ea1991818eec2e00e653cc0030e46ed93a43280ece9f.dll
Size

33KB
MD5

01b31745a59128af54875a96f778f151
SHA1

725c5db158b5358fb949e5460ef22914a06ad382
SHA256

580799f4eaaa31f433b1ea1991818eec2e00e653cc0030e46ed93a43280ece9f
SHA512

f280f20cba1e20db9fa9040c8b013f4a53e0d73fe690a0ebabde001dccc6b3cbfddc089ab602bfbee4cb9596f84d6ecb6903052d0faec03819f0d02c2065097b
SSDEEP

768:V+aoi6qZOpQB5ZpOc06HCMN9GT6RJ5BHUEy2YEZZEo:V+av6qZ4QxpP0AtNfRJ5BHxY

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28
PID 1632 wrote to memory of 912	1632	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\580799f4eaaa31f433b1ea1991818eec2e00e653cc0030e46ed93a43280ece9f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\580799f4eaaa31f433b1ea1991818eec2e00e653cc0030e46ed93a43280ece9f.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:912

memory/912-55-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/912-56-0x0000000000160000-0x000000000016E000-memory.dmp

Filesize
56KB

Download