2ef9ae089b326e8c1da8637e92b0c5061958621f9141e5dd5f743047b3d017aa

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 18:50

Target

2ef9ae089b326e8c1da8637e92b0c5061958621f9141e5dd5f743047b3d017aa.dll
Size

752KB
MD5

92b3b58acb634b765a5a3f84b7fe0800
SHA1

4ef138c46f41a80733f81fa15fc4446cdc62cb9a
SHA256

2ef9ae089b326e8c1da8637e92b0c5061958621f9141e5dd5f743047b3d017aa
SHA512

52be6032ea9f0c6c7fff389981da6584bfc12808682e275d8f860d86c7a23a84515b0a6e3529d55a908c1dd340ebfb84176849ad75c59234550c2330e63c20ef
SSDEEP

6144:TEM0cPwx5PShJ3oG7rgMsilg/By6z+s8rOYkIcgpGvRjf4vDOnbPFmUdttncesI1:TI84Yoqnsilg5yCI8cG5jwOnbPF95si

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1204	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	rundll32.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28
PID 112 wrote to memory of 1204	112	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ef9ae089b326e8c1da8637e92b0c5061958621f9141e5dd5f743047b3d017aa.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ef9ae089b326e8c1da8637e92b0c5061958621f9141e5dd5f743047b3d017aa.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1204

memory/1204-55-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download