41248f4d692212e35becabf0255e71405f2484f9d0db998a048b97b2320b4087

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26-02-2023 20:09

Target

41248f4d692212e35becabf0255e71405f2484f9d0db998a048b97b2320b4087.dll
Size

992KB
MD5

d63bab5c3a6a24199af6dc023b17c62c
SHA1

e0972397f9ab64d58ab95203ecfeff15d5c2997c
SHA256

41248f4d692212e35becabf0255e71405f2484f9d0db998a048b97b2320b4087
SHA512

87e45ba4ad7979279fbf05d83c325d9a49b8da2578c98deff3a23db32f3af483cfe016f730affa8c7ce4311c546d28f7753f4b56b7a0e023798570d41721589a
SSDEEP

24576:6N3Dm6URDyyu8iQx/KQZqmTeJyu1QFN7wUM0i:6MuBTeFwWwU+

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

rundll32.exe

description pid process

Token: SeDebugPrivilege 1308 rundll32.exe

description	pid	process
Token: SeDebugPrivilege	1308	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1192 wrote to memory of 1308	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1308	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1308	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1308	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1308	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1308	1192	rundll32.exe	rundll32.exe
PID 1192 wrote to memory of 1308	1192	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41248f4d692212e35becabf0255e71405f2484f9d0db998a048b97b2320b4087.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\41248f4d692212e35becabf0255e71405f2484f9d0db998a048b97b2320b4087.dll,#1
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308