17c9736a7bc54c6b3460263d8b67f1f7c7cf8d95d1a29b24327e48fd6af2a2d3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/12/2023, 11:19

Target

17c9736a7bc54c6b3460263d8b67f1f7c7cf8d95d1a29b24327e48fd6af2a2d3.dll
Size

397KB
MD5

c5feb5182d83c37ee48e2599e81f5243
SHA1

a4f9f0bd552a228d917a0cf3b0c64c8d31723362
SHA256

17c9736a7bc54c6b3460263d8b67f1f7c7cf8d95d1a29b24327e48fd6af2a2d3
SHA512

d36b6b462011667b8cf2b3458df2100e268dadf883c2e5ee22f6358590b9a7ae5843a3f64e1ff84dee62eee6624cfce2dee2db3349d733c41abc47c3bf63410b
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaP:174g2LDeiPDImOkx2LIaP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	rundll32.exe
Token: SeTcbPrivilege	1748	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1748	1520	rundll32.exe	14
PID 1520 wrote to memory of 1748	1520	rundll32.exe	14
PID 1520 wrote to memory of 1748	1520	rundll32.exe	14
PID 1520 wrote to memory of 1748	1520	rundll32.exe	14
PID 1520 wrote to memory of 1748	1520	rundll32.exe	14
PID 1520 wrote to memory of 1748	1520	rundll32.exe	14
PID 1520 wrote to memory of 1748	1520	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\17c9736a7bc54c6b3460263d8b67f1f7c7cf8d95d1a29b24327e48fd6af2a2d3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1520