0809e48873261c7b611ba93c4d75c54d2969626ed1ca302b46059d30b5e789c2

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24-12-2023 14:13

Target

0809e48873261c7b611ba93c4d75c54d2969626ed1ca302b46059d30b5e789c2.dll
Size

397KB
MD5

0b5282693bbb7df2e8fbfd85ec4039c5
SHA1

d6f838da82132e7f7031ee93cababc38863ad344
SHA256

0809e48873261c7b611ba93c4d75c54d2969626ed1ca302b46059d30b5e789c2
SHA512

cf673a28cdba17ff97c10233595a4c266e5af88c95cc0f025508e55b89080390138da811044c26716e610faea5478ad441a00acdf9d8def72bd7ff15970ec993
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaP:174g2LDeiPDImOkx2LIaP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	rundll32.exe
Token: SeTcbPrivilege	1944	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1944	1756	rundll32.exe	28
PID 1756 wrote to memory of 1944	1756	rundll32.exe	28
PID 1756 wrote to memory of 1944	1756	rundll32.exe	28
PID 1756 wrote to memory of 1944	1756	rundll32.exe	28
PID 1756 wrote to memory of 1944	1756	rundll32.exe	28
PID 1756 wrote to memory of 1944	1756	rundll32.exe	28
PID 1756 wrote to memory of 1944	1756	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0809e48873261c7b611ba93c4d75c54d2969626ed1ca302b46059d30b5e789c2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0809e48873261c7b611ba93c4d75c54d2969626ed1ca302b46059d30b5e789c2.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944