3ecba5c66188f83a89dce0845beed3960c735e1485c1facc73d1d14c1574e174

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 23:19

Target

18ec1365d61aa8b75319a77d0bed8b24.dll
Size

308KB
MD5

18ec1365d61aa8b75319a77d0bed8b24
SHA1

8ce7e16bba37ea62974f3f877c8ba84f84d2a8ae
SHA256

3ecba5c66188f83a89dce0845beed3960c735e1485c1facc73d1d14c1574e174
SHA512

32550b741a7d8e3852c69086ec0c698184e7f9c6946a06d2cbdeea90a4521250511e70f6cd3961f5879fdc4ed17bd8874b632699a694e6ef3d922d8b1210ac3f
SSDEEP

6144:0LVQzGcA0ucRlXUVk2jWP6VMGB5nvLXuCIFJlVphypjajpjTB8uSkAcC:Hz7ucRlCkkWyj53mVphypWjpjTKuCr

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	rundll32.exe
3004	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3004	2960	rundll32.exe	16
PID 2960 wrote to memory of 3004	2960	rundll32.exe	16
PID 2960 wrote to memory of 3004	2960	rundll32.exe	16
PID 2960 wrote to memory of 3004	2960	rundll32.exe	16
PID 2960 wrote to memory of 3004	2960	rundll32.exe	16
PID 2960 wrote to memory of 3004	2960	rundll32.exe	16
PID 2960 wrote to memory of 3004	2960	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\18ec1365d61aa8b75319a77d0bed8b24.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\18ec1365d61aa8b75319a77d0bed8b24.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004