0bc8b078785cb3c1b0ba9644efbde0ff8d99c2af80e542bafbba2514e31dc73a

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 13:57

Target

0bc8b078785cb3c1b0ba9644efbde0ff8d99c2af80e542bafbba2514e31dc73a.dll
Size

397KB
MD5

3a9820da6bbbb08f696c7f6e90bab964
SHA1

39af3b3b1dbf7e8b9df6f4a4c11e77244e23801c
SHA256

0bc8b078785cb3c1b0ba9644efbde0ff8d99c2af80e542bafbba2514e31dc73a
SHA512

0b914f649c0b6a2d07cd325cf580ea2363d101b55ff2c82edff81b23575cfe5e4aff2a1eb7b62f2959bf3575ee7bcc5cfa3ab568dbee476fd7a3a992586afcca
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaW:174g2LDeiPDImOkx2LIaW

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2216	rundll32.exe
2216	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	rundll32.exe
Token: SeTcbPrivilege	2216	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2216	2072	rundll32.exe	14
PID 2072 wrote to memory of 2216	2072	rundll32.exe	14
PID 2072 wrote to memory of 2216	2072	rundll32.exe	14
PID 2072 wrote to memory of 2216	2072	rundll32.exe	14
PID 2072 wrote to memory of 2216	2072	rundll32.exe	14
PID 2072 wrote to memory of 2216	2072	rundll32.exe	14
PID 2072 wrote to memory of 2216	2072	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0bc8b078785cb3c1b0ba9644efbde0ff8d99c2af80e542bafbba2514e31dc73a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072