ed304a997b308a26d5f122b844438289ea7582df6842af2352af8aca01b1c039

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 22:51

Target

ed304a997b308a26d5f122b844438289ea7582df6842af2352af8aca01b1c039.dll
Size

200KB
MD5

03b7af49735529ca340da6d557c0f65d
SHA1

d7eb5d013f1fabf38b8ad202f39746784d48e89a
SHA256

ed304a997b308a26d5f122b844438289ea7582df6842af2352af8aca01b1c039
SHA512

25214ba72fb4308bbde09d8156bc3686ba2e6181394a6518d6d1eaf95777539af429e3bde7bb85c3d85f3fbbb479453097c3dbd0897f825817619b400ec59fb3
SSDEEP

3072:fnF8LYF7C0Uoicer1twUYAQiZxSv1VDPqfgFFshInVJg021CeBExtlL2ZfWnw3Wd:vF8s7fUSeo6dh1CeBtXs0zqqDG6a+

Score

1^/10

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1996	rundll32.exe
Token: SeSecurityPrivilege	1996	rundll32.exe
Token: SeTakeOwnershipPrivilege	1996	rundll32.exe
Token: SeLoadDriverPrivilege	1996	rundll32.exe
Token: SeSystemProfilePrivilege	1996	rundll32.exe
Token: SeSystemtimePrivilege	1996	rundll32.exe
Token: SeProfSingleProcessPrivilege	1996	rundll32.exe
Token: SeIncBasePriorityPrivilege	1996	rundll32.exe
Token: SeCreatePagefilePrivilege	1996	rundll32.exe
Token: SeShutdownPrivilege	1996	rundll32.exe
Token: SeDebugPrivilege	1996	rundll32.exe
Token: SeSystemEnvironmentPrivilege	1996	rundll32.exe
Token: SeRemoteShutdownPrivilege	1996	rundll32.exe
Token: SeUndockPrivilege	1996	rundll32.exe
Token: SeManageVolumePrivilege	1996	rundll32.exe
Token: 33	1996	rundll32.exe
Token: 34	1996	rundll32.exe
Token: 35	1996	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27
PID 1984 wrote to memory of 1996	1984	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed304a997b308a26d5f122b844438289ea7582df6842af2352af8aca01b1c039.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ed304a997b308a26d5f122b844438289ea7582df6842af2352af8aca01b1c039.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1996

memory/1996-55-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1996-56-0x00000000001E0000-0x0000000000218000-memory.dmp

Filesize
224KB

Download