b4349a8c55d2d364e52b485a9da36543afb172ab810bdf9df3d2998daa06e176

Analysis

max time kernel
28s
max time network
31s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/06/2023, 19:23

Target

b4349a8c55d2d364e52b485a9da36543afb172ab810bdf9df3d2998daa06e176.dll
Size

83KB
MD5

2da3c812ce1c21ca1222ed4b2a0ae7e1
SHA1

fec1e001ef1bd8c69612fa99da9953d4050a2eac
SHA256

b4349a8c55d2d364e52b485a9da36543afb172ab810bdf9df3d2998daa06e176
SHA512

adc5195778f95d83affd3199faf2e4138da193e816eba30dd2abe47a177d368557b96ccae2960a7eeddcaaaf441b6591f32b9cc092bf594588d6ba32b5647755
SSDEEP

1536:iyXi33nrvbsTfvMtExf5strgV9JrnX6VG+GRi35LTapQb:i0WrknMOktrgJoG+GR85/apC

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1468	rundll32.exe
Token: SeIncBasePriorityPrivilege	1468	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 1468	840	rundll32.exe	28
PID 840 wrote to memory of 1468	840	rundll32.exe	28
PID 840 wrote to memory of 1468	840	rundll32.exe	28
PID 840 wrote to memory of 1468	840	rundll32.exe	28
PID 840 wrote to memory of 1468	840	rundll32.exe	28
PID 840 wrote to memory of 1468	840	rundll32.exe	28
PID 840 wrote to memory of 1468	840	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4349a8c55d2d364e52b485a9da36543afb172ab810bdf9df3d2998daa06e176.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4349a8c55d2d364e52b485a9da36543afb172ab810bdf9df3d2998daa06e176.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1468