af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd

Analysis

max time kernel
7s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:59

Target

af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll
Size

311KB
MD5

0dbf2e5fbcbc2a0f8128dac471ae1781
SHA1

18cc048f3dc7053f242b8c9cc4996ea7ca9b8ec1
SHA256

af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd
SHA512

7c26fe65cf712d72460d2c01c7e9bacfc23608646a516c9b0f7cff31e5f4bdc540ec5a44815e69c742f3f08fc179e68c2ef14138211a0f703f812e608b93b205
SSDEEP

6144:iqNG9C3ucRmzvXuQovJS0WEuE8c7eKfryJDvaLqi7LGjeOTB1VwAfAK:pNJucRmD5IJru67MaLqi76jeOT3h4K

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1236	rundll32.exe
1236	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1236	948	rundll32.exe	27
PID 948 wrote to memory of 1236	948	rundll32.exe	27
PID 948 wrote to memory of 1236	948	rundll32.exe	27
PID 948 wrote to memory of 1236	948	rundll32.exe	27
PID 948 wrote to memory of 1236	948	rundll32.exe	27
PID 948 wrote to memory of 1236	948	rundll32.exe	27
PID 948 wrote to memory of 1236	948	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af0a4a9ba6f3f73f9e140f4a4d93f183a2e12716aaceeea4d23ef9cc7b983ccd.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1236

memory/1236-55-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download