774fe5513942d75d8f6a5f2f27cd86dd3cd93d81b1b52da4ccbfea848f83f5bf

Analysis

max time kernel
101s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:57

Target

774fe5513942d75d8f6a5f2f27cd86dd3cd93d81b1b52da4ccbfea848f83f5bf.dll
Size

136KB
MD5

3f4987ab812403598b0605fd3701f690
SHA1

4b25d4393d069f145086e70bebdf8b8bbba94876
SHA256

774fe5513942d75d8f6a5f2f27cd86dd3cd93d81b1b52da4ccbfea848f83f5bf
SHA512

68234ad9e6d42f490e1a40a1bc6a312d18c018eb42b3f2a53ff71c1061089b54ac23aa76a2747eee75323b16ce184883129e155c377731db80d9879011849f58
SSDEEP

3072:Me6GrvvxE6pnDMe6VBwwxXeiNxiCqhPFakQRwiRjZD:YO1nDMLFxFIPFakQ+

Score

4^/10

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Fdoa\Ftagqyjir.pic	rundll32.exe
File created	C:\Program Files (x86)\Fdoa\Ftagqyjir.pic	rundll32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1976	2044	rundll32.exe	28
PID 2044 wrote to memory of 1976	2044	rundll32.exe	28
PID 2044 wrote to memory of 1976	2044	rundll32.exe	28
PID 2044 wrote to memory of 1976	2044	rundll32.exe	28
PID 2044 wrote to memory of 1976	2044	rundll32.exe	28
PID 2044 wrote to memory of 1976	2044	rundll32.exe	28
PID 2044 wrote to memory of 1976	2044	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\774fe5513942d75d8f6a5f2f27cd86dd3cd93d81b1b52da4ccbfea848f83f5bf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\774fe5513942d75d8f6a5f2f27cd86dd3cd93d81b1b52da4ccbfea848f83f5bf.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1976

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k imgsvW
1⤵
PID:1336

memory/1976-55-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download