c0d9c40228ce8737133de0fe948fadb2d0523f6a5f737621b1dc358d93601686

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 21:05

Target

c0d9c40228ce8737133de0fe948fadb2d0523f6a5f737621b1dc358d93601686.dll
Size

3.3MB
MD5

35106c0a97a75677ce62ea4f39d61e4c
SHA1

a7875d5b58c79e66d5a01ec78fae8091ed3658df
SHA256

c0d9c40228ce8737133de0fe948fadb2d0523f6a5f737621b1dc358d93601686
SHA512

6841085ccbd61e4296150cf178108ff491851c74f04b4fcf96846d87b7cae941181d460f8b70a813044fc0a187d140b72ed1bbd29a0f6ba54387164275a24d89
SSDEEP

49152:iXPwh11sXIAyT9tN93gs5SkP2lS1mdM03aT1Pfnp8+wINC0:qPs1sByTr5SQrWM03o1R8+wIN/

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	1912	rundll32.exe
9	1912	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowSystemNewUpdate874.log	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1912	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 1912	2288	rundll32.exe	27
PID 2288 wrote to memory of 1912	2288	rundll32.exe	27
PID 2288 wrote to memory of 1912	2288	rundll32.exe	27
PID 2288 wrote to memory of 1912	2288	rundll32.exe	27
PID 2288 wrote to memory of 1912	2288	rundll32.exe	27
PID 2288 wrote to memory of 1912	2288	rundll32.exe	27
PID 2288 wrote to memory of 1912	2288	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0d9c40228ce8737133de0fe948fadb2d0523f6a5f737621b1dc358d93601686.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0d9c40228ce8737133de0fe948fadb2d0523f6a5f737621b1dc358d93601686.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1912

memory/1912-0-0x0000000075370000-0x0000000075473000-memory.dmp

Filesize
1.0MB

Download
memory/1912-3-0x0000000075260000-0x0000000075363000-memory.dmp

Filesize
1.0MB

Download
memory/1912-1-0x0000000075370000-0x0000000075473000-memory.dmp

Filesize
1.0MB

Download
memory/1912-4-0x0000000075260000-0x0000000075363000-memory.dmp

Filesize
1.0MB

Download
memory/1912-8-0x0000000075260000-0x0000000075363000-memory.dmp

Filesize
1.0MB

Download
memory/1912-9-0x0000000075370000-0x0000000075375000-memory.dmp

Filesize
20KB

Download