b6e3eb3bba1f8b4681a52420f292117adc0706d59949e4bddc4739528ca6395d

Analysis

max time kernel
248s
max time network
331s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 00:17

Target

b6e3eb3bba1f8b4681a52420f292117adc0706d59949e4bddc4739528ca6395d.dll
Size

159KB
MD5

85b57c32bf0cc276bfcd20081ee0a21c
SHA1

4d3eb58b49f140dcd3504c790f502e546568b17a
SHA256

b6e3eb3bba1f8b4681a52420f292117adc0706d59949e4bddc4739528ca6395d
SHA512

c8334b8f719ce5c06b32551ce4a200698c245b106be837f52949c69fee2900e1c4213319e69cc1580ecdb9e4c2bbc3f7b07dcf678b1289db6c6c1b6e16a7bf11
SSDEEP

3072:zvKBqW2Ds3vjDzvFZCN77vgttSg8CqFjKnUH:N7vgWg8C9nG

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1484	rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 1484	332	rundll32.exe	28
PID 332 wrote to memory of 1484	332	rundll32.exe	28
PID 332 wrote to memory of 1484	332	rundll32.exe	28
PID 332 wrote to memory of 1484	332	rundll32.exe	28
PID 332 wrote to memory of 1484	332	rundll32.exe	28
PID 332 wrote to memory of 1484	332	rundll32.exe	28
PID 332 wrote to memory of 1484	332	rundll32.exe	28
PID 1484 wrote to memory of 1692	1484	rundll32.exe	29
PID 1484 wrote to memory of 1692	1484	rundll32.exe	29
PID 1484 wrote to memory of 1692	1484	rundll32.exe	29
PID 1484 wrote to memory of 1692	1484	rundll32.exe	29
PID 1484 wrote to memory of 1692	1484	rundll32.exe	29
PID 1484 wrote to memory of 1692	1484	rundll32.exe	29
PID 1484 wrote to memory of 1692	1484	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6e3eb3bba1f8b4681a52420f292117adc0706d59949e4bddc4739528ca6395d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:332
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b6e3eb3bba1f8b4681a52420f292117adc0706d59949e4bddc4739528ca6395d.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe" /ppiftsvc
    3⤵
    PID:1692

memory/1484-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1484-59-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1484-58-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1484-60-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download