c706f2272de6fa21de23301f0519ff5322b9488af090f25cb129330756457110

Analysis

max time kernel
144s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 05:18

Target

c706f2272de6fa21de23301f0519ff5322b9488af090f25cb129330756457110.dll
Size

174KB
MD5

6f5cc23dafbff41f0f036680da7c8170
SHA1

e5387501615c17b6b9dde73a2d711122ed7e23fa
SHA256

c706f2272de6fa21de23301f0519ff5322b9488af090f25cb129330756457110
SHA512

bbbf576815aadcbd099093af9b069e74596df58206d00cce86ece9116391208e3b44b91fb0a51ce5bc99bb004ebdc5853fc3f2581aa2e9dab305e762a7dcf7cc
SSDEEP

3072:aolkso2ncyHFc306SdkqxF/ORZ44hTItxCqfaLYj/9etc6eY56W7JX:ObicyEadkA8RV+xJaLYjItcS56W7JX

Score

8^/10

Blocklisted process makes network request 1 IoCs

flow	pid	Process
1	1312	rundll32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\registry\machine\Software\Classes\Interface\{39d92504-9fba-0be7-422b-8edf7031cb36}	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39d92504-9fba-0be7-422b-8edf7031cb36}\u = "188"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39d92504-9fba-0be7-422b-8edf7031cb36}\cid = "8751950697006140525"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1276	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	rundll32.exe
Token: SeShutdownPrivilege	1276	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1312	1324	rundll32.exe	28
PID 1324 wrote to memory of 1312	1324	rundll32.exe	28
PID 1324 wrote to memory of 1312	1324	rundll32.exe	28
PID 1324 wrote to memory of 1312	1324	rundll32.exe	28
PID 1324 wrote to memory of 1312	1324	rundll32.exe	28
PID 1324 wrote to memory of 1312	1324	rundll32.exe	28
PID 1324 wrote to memory of 1312	1324	rundll32.exe	28
PID 1312 wrote to memory of 1276	1312	rundll32.exe	18

memory/1276-56-0x0000000001E00000-0x0000000001E06000-memory.dmp

Filesize
24KB

Download
memory/1276-64-0x0000000001E00000-0x0000000001E06000-memory.dmp

Filesize
24KB

Download
memory/1276-60-0x0000000001E00000-0x0000000001E06000-memory.dmp

Filesize
24KB

Download
memory/1312-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1312-65-0x000000000024E000-0x0000000000270000-memory.dmp

Filesize
136KB

Download