1728a077a3bcbf180d0c09aea0c77ed1f15574d2f451288e480158ca00686b25

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
24/11/2023, 16:01

Target

1728a077a3bcbf180d0c09aea0c77ed1f15574d2f451288e480158ca00686b25.dll
Size

4.6MB
MD5

ce1d47446f018fa2a91f70db137ac929
SHA1

0ab8917d7c42384a68802b2a676422a68ed10e13
SHA256

1728a077a3bcbf180d0c09aea0c77ed1f15574d2f451288e480158ca00686b25
SHA512

3a8faad8183d445879459514fdf3bfeeba2f15132a58680d46c80eefbbfd5009cbc14386b99ab94106723b0ca85c6571a1bd000a6b1321d7f333e677f0a55176
SSDEEP

49152:YRjozbc5aBHDMk8gGzKL2faMIzZZsdZo/3KFu9J16X9gQT9L:3EE8gGY2faMaWdm36AJ1SKQT

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1600	rundll32.exe
1600	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	rundll32.exe
Token: SeDebugPrivilege	1600	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1600	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28
PID 2800 wrote to memory of 1600	2800	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1728a077a3bcbf180d0c09aea0c77ed1f15574d2f451288e480158ca00686b25.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1728a077a3bcbf180d0c09aea0c77ed1f15574d2f451288e480158ca00686b25.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1600