76c5609cf5919ad8729a0f5df899790dcf6764a73ed13e6c51879a3213a1216f

Analysis

max time kernel
29s
max time network
31s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 20:17

Target

76c5609cf5919ad8729a0f5df899790dcf6764a73ed13e6c51879a3213a1216f.dll
Size

3.5MB
MD5

4c52d5aae21ac3406523c02a1e1133e7
SHA1

f390b89fe1f09c013349a9c0f435fde4d317ad61
SHA256

76c5609cf5919ad8729a0f5df899790dcf6764a73ed13e6c51879a3213a1216f
SHA512

5193a94c9355f551b8136d55fb26c80cc82394295a247830f3ff6450c0f7c468331e619755645ed2c027124c46db06b175ed5d9d333eed2f62be6740e7f678d1
SSDEEP

24576:FuC6IvUJhXdapbthCnQs6SU2y1+NKc77bLCbSk/XSj1jBO:TtvUJ5daF6QPSy1+NsSnjB

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process
PID 1988 created 0	1988	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1988	rundll32.exe
1988	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1988	rundll32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1988	1952	rundll32.exe	28
PID 1952 wrote to memory of 1988	1952	rundll32.exe	28
PID 1952 wrote to memory of 1988	1952	rundll32.exe	28
PID 1952 wrote to memory of 1988	1952	rundll32.exe	28
PID 1952 wrote to memory of 1988	1952	rundll32.exe	28
PID 1952 wrote to memory of 1988	1952	rundll32.exe	28
PID 1952 wrote to memory of 1988	1952	rundll32.exe	28
PID 1988 wrote to memory of 1604	1988	rundll32.exe	29
PID 1988 wrote to memory of 1604	1988	rundll32.exe	29
PID 1988 wrote to memory of 1604	1988	rundll32.exe	29
PID 1988 wrote to memory of 1604	1988	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\76c5609cf5919ad8729a0f5df899790dcf6764a73ed13e6c51879a3213a1216f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\76c5609cf5919ad8729a0f5df899790dcf6764a73ed13e6c51879a3213a1216f.dll,#1
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\System32\cmd.exe
    3⤵
    PID:1604

memory/1988-54-0x0000000010000000-0x00000000101D7000-memory.dmp

Filesize
1.8MB

Download