bd750b7baafb1959ff6128bb46956970e5ecb646dd7815906d30ba4db86f6c89

Analysis

max time kernel
46s
max time network
87s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 14:10

Reason

Machine shutdown

Target

bd750b7baafb1959ff6128bb46956970e5ecb646dd7815906d30ba4db86f6c89.dll
Size

737KB
MD5

90d1acf8dc6c3602f914b637f08142a8
SHA1

8fe288604a93c1ef6d9a75018e7494b5df57c028
SHA256

bd750b7baafb1959ff6128bb46956970e5ecb646dd7815906d30ba4db86f6c89
SHA512

25bcfad5e813c257e5b4534840b58dab8e1a9177128459044deb06ecf985ca635219760685f34f653c36647f750fc00a3ab6c5dcb3c72305cbbe857da829c973
SSDEEP

12288:0jVMjGV3yRwdtHo7YNQgBeW8/LViyIakQz15bbPIbPfnF8QZbmqMrUACWS8dJBKy:OmGV3ye/IwQhiyIakELwjPyQZbmNrUvJ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1600	shutdown.exe
Token: SeRemoteShutdownPrivilege	1600	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1412	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 1412	1360	rundll32.exe	28
PID 1360 wrote to memory of 1412	1360	rundll32.exe	28
PID 1360 wrote to memory of 1412	1360	rundll32.exe	28
PID 1360 wrote to memory of 1412	1360	rundll32.exe	28
PID 1360 wrote to memory of 1412	1360	rundll32.exe	28
PID 1360 wrote to memory of 1412	1360	rundll32.exe	28
PID 1360 wrote to memory of 1412	1360	rundll32.exe	28
PID 1412 wrote to memory of 1036	1412	rundll32.exe	29
PID 1412 wrote to memory of 1036	1412	rundll32.exe	29
PID 1412 wrote to memory of 1036	1412	rundll32.exe	29
PID 1412 wrote to memory of 1036	1412	rundll32.exe	29
PID 1036 wrote to memory of 1600	1036	cmd.exe	31
PID 1036 wrote to memory of 1600	1036	cmd.exe	31
PID 1036 wrote to memory of 1600	1036	cmd.exe	31
PID 1036 wrote to memory of 1600	1036	cmd.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd750b7baafb1959ff6128bb46956970e5ecb646dd7815906d30ba4db86f6c89.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd750b7baafb1959ff6128bb46956970e5ecb646dd7815906d30ba4db86f6c89.dll,#1
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown -s -f -t 00
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -s -f -t 00
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1600

memory/584-58-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download
memory/1036-56-0x0000000000000000-mapping.dmp

Download
memory/1412-54-0x0000000000000000-mapping.dmp

Download
memory/1412-55-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1412-59-0x00000000741D0000-0x00000000745C9000-memory.dmp

Filesize
4.0MB

Download
memory/1600-57-0x0000000000000000-mapping.dmp

Download