a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29/08/2023, 01:05

Target

a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll
Size

3.6MB
MD5

a285d236f4bc221cae4f07407c6c4bb4
SHA1

7f85a28da3d659443e56892b5325eedc2702fabd
SHA256

a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a
SHA512

e4e3fdd3efb710a9a18c74f2329f5e75faf9a9483bad0c35999dcee952c5c532c15b66a5d2956d63753ee7770448323b42934a9b1dd1f48f0e289816ec375d53
SSDEEP

49152:tzzvNtsvz12Acn9CkZ0X2hff/yC3G/j111Y111D111CRB6+zINs4:pzjo1yrpR3f8111Y111D111k6+zINx

Score

8^/10

Blocklisted process makes network request 3 IoCs

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowSystemNewUpdate620.log	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2200	2516	rundll32.exe	28
PID 2516 wrote to memory of 2200	2516	rundll32.exe	28
PID 2516 wrote to memory of 2200	2516	rundll32.exe	28
PID 2516 wrote to memory of 2200	2516	rundll32.exe	28
PID 2516 wrote to memory of 2200	2516	rundll32.exe	28
PID 2516 wrote to memory of 2200	2516	rundll32.exe	28
PID 2516 wrote to memory of 2200	2516	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a445c69815c003f4ace0cb4ae8d0adb1f839b8443a7975f08ca016352984499a.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2200