b7f51322b61bd4f1d99c75caf1a703eb6582e7d77991e335123abeeb07089720

Analysis

max time kernel
3s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 16:43

Target

b7f51322b61bd4f1d99c75caf1a703eb6582e7d77991e335123abeeb07089720.dll
Size

736KB
MD5

ab7cf5794b07329504d22f89e1c8d348
SHA1

934849df3308ac1193b23d0432fe112f5c5ffe90
SHA256

b7f51322b61bd4f1d99c75caf1a703eb6582e7d77991e335123abeeb07089720
SHA512

db866513faece7253f9146c9dcaf5ce24ddbaae7edccb86a58dbf4de7257e28851871dbe7457a588550740942e25d64ca844a7932a1b7a56984448c04928bffa
SSDEEP

12288:r94G2krDlMBD+e6VOkBoUDxHhmnP/1RI0Vmg+YDcLTDZhifm6KR0:54wlODa93Bk1RI0VmnYILvZgm6l

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1284	rundll32.exe
1284	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1284	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1284	1352	rundll32.exe	28
PID 1352 wrote to memory of 1284	1352	rundll32.exe	28
PID 1352 wrote to memory of 1284	1352	rundll32.exe	28
PID 1352 wrote to memory of 1284	1352	rundll32.exe	28
PID 1352 wrote to memory of 1284	1352	rundll32.exe	28
PID 1352 wrote to memory of 1284	1352	rundll32.exe	28
PID 1352 wrote to memory of 1284	1352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7f51322b61bd4f1d99c75caf1a703eb6582e7d77991e335123abeeb07089720.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b7f51322b61bd4f1d99c75caf1a703eb6582e7d77991e335123abeeb07089720.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1284

memory/1284-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1284-56-0x0000000010000000-0x00000000100C8000-memory.dmp

Filesize
800KB

Download