cfa0d59ebae84c10e974d835cc843fa75a3ed8cff0ee96da0d70e45b72ec62f0

Analysis

max time kernel
10s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 13:18

Target

cfa0d59ebae84c10e974d835cc843fa75a3ed8cff0ee96da0d70e45b72ec62f0.dll
Size

25KB
MD5

8fd9b022390496e374f68423063e481c
SHA1

908876e5734396eb7d5174d31610543f35df7e2f
SHA256

cfa0d59ebae84c10e974d835cc843fa75a3ed8cff0ee96da0d70e45b72ec62f0
SHA512

3d8b8c76eac9f8d03aba26900d69f74afebdf78187035e95c75dd6dae03c86b29062cd573b366b23b3c2dd21ae77a57e79671ea4812b8e2853859b6fc03f5078
SSDEEP

192:V22iKUQ3pWLrV8g7NmAlaOoun5p9xqI1bunb1AYNn8JaF09K6RmdDM1n:VSjHV8wwTWxxXeBWJayHRm

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	940	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28
PID 1376 wrote to memory of 940	1376	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfa0d59ebae84c10e974d835cc843fa75a3ed8cff0ee96da0d70e45b72ec62f0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cfa0d59ebae84c10e974d835cc843fa75a3ed8cff0ee96da0d70e45b72ec62f0.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:940

memory/940-55-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/940-56-0x0000000020000000-0x00000000208FE000-memory.dmp

Filesize
9.0MB

Download