8f5b532e2ffa2fb6f4a0f2f7eafed07ab8318b768a917a48dea0f17901e4b93a

Analysis

max time kernel
237s
max time network
337s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:44

Target

8f5b532e2ffa2fb6f4a0f2f7eafed07ab8318b768a917a48dea0f17901e4b93a.dll
Size

308KB
MD5

eb3be2442eb17ac2dd876b8aaff4b2de
SHA1

d48abd531cca92597d90cde08f47b3cd576534da
SHA256

8f5b532e2ffa2fb6f4a0f2f7eafed07ab8318b768a917a48dea0f17901e4b93a
SHA512

bcc42a9ac40f704f5b8896bd07f83f9ddf06cddb0d339d33cbeec5485833cefd427aa0924f869364d7ab11057fd39eb96800e296ffdf69727b7694977ea305e5
SSDEEP

6144:nqVALbcQkucRB5ZVk2zBP66MGc1jmPn8zRRNDjU08gXLaajpeTBsuloAZs:rL8ucRBhkUByP1p7f8gXL9jpeTauxm

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
668	rundll32.exe
668	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	668	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 668	1500	rundll32.exe	28
PID 1500 wrote to memory of 668	1500	rundll32.exe	28
PID 1500 wrote to memory of 668	1500	rundll32.exe	28
PID 1500 wrote to memory of 668	1500	rundll32.exe	28
PID 1500 wrote to memory of 668	1500	rundll32.exe	28
PID 1500 wrote to memory of 668	1500	rundll32.exe	28
PID 1500 wrote to memory of 668	1500	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f5b532e2ffa2fb6f4a0f2f7eafed07ab8318b768a917a48dea0f17901e4b93a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8f5b532e2ffa2fb6f4a0f2f7eafed07ab8318b768a917a48dea0f17901e4b93a.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:668

memory/668-55-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download