1b76a31ef64ed6420c0fab162a3a3c1922ec7bc7b79a7f1ba79f7e4a32b4d5bc

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/09/2023, 03:24

Target

1b76a31ef64ed6420c0fab162a3a3c1922ec7bc7b79a7f1ba79f7e4a32b4d5bc.dll
Size

3.2MB
MD5

d265eb450f6e62fbd2508d798af10c00
SHA1

fa734927dae58329bcc01a653addda375a9e4762
SHA256

1b76a31ef64ed6420c0fab162a3a3c1922ec7bc7b79a7f1ba79f7e4a32b4d5bc
SHA512

6b7fb305a1821a161564d7c7ba6ccc0eed5ba7cea47646f130e6715b58a804f7dbf6c3b3a8d15694c25407359a67ca9dacb244f5bdff00a8ffd1197ed2887894
SSDEEP

49152:SV8r+Dw6Le3qD0oQwCnLwAaa7fAyqM1sSzb+vEasT/iX5VTDa7rQOQG:S6rdGD0LLVjfALPYiX5YP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1600	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1600	2080	rundll32.exe	28
PID 2080 wrote to memory of 1600	2080	rundll32.exe	28
PID 2080 wrote to memory of 1600	2080	rundll32.exe	28
PID 2080 wrote to memory of 1600	2080	rundll32.exe	28
PID 2080 wrote to memory of 1600	2080	rundll32.exe	28
PID 2080 wrote to memory of 1600	2080	rundll32.exe	28
PID 2080 wrote to memory of 1600	2080	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b76a31ef64ed6420c0fab162a3a3c1922ec7bc7b79a7f1ba79f7e4a32b4d5bc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1b76a31ef64ed6420c0fab162a3a3c1922ec7bc7b79a7f1ba79f7e4a32b4d5bc.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1600

memory/1600-0-0x0000000074C70000-0x000000007500E000-memory.dmp

Filesize
3.6MB

Download
memory/1600-1-0x0000000074C70000-0x000000007500E000-memory.dmp

Filesize
3.6MB

Download
memory/1600-2-0x00000000748D0000-0x0000000074C6E000-memory.dmp

Filesize
3.6MB

Download
memory/1600-3-0x0000000074C70000-0x000000007500E000-memory.dmp

Filesize
3.6MB

Download
memory/1600-4-0x00000000748D0000-0x0000000074C6E000-memory.dmp

Filesize
3.6MB

Download