742c7f2690c3b07975168d4e0065dc484e3742e06e0e1a825affe974dd74bd0f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:44

Target

0c78074cd4eaf0195102ebe4452316cf.dll
Size

748KB
MD5

0c78074cd4eaf0195102ebe4452316cf
SHA1

e145cbe3e38b9360ac23bbafa2f75456ecdfc85d
SHA256

742c7f2690c3b07975168d4e0065dc484e3742e06e0e1a825affe974dd74bd0f
SHA512

09ff7ddd2789abe074f0e43fbe26035225f98011cb0901f1a51595ca7c8beb99dccdd5a36f628eab656597951cfc5c96a353b11a4e47533c14bc506497cedc8d
SSDEEP

12288:tDryfjRC9YFcxwMSbPXxdCmYytwrkgL4rRciH65:tDryf92twMWtbwggL4dcA65

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1836	rundll32.exe
1836	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1836	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1836	1848	rundll32.exe	14
PID 1848 wrote to memory of 1836	1848	rundll32.exe	14
PID 1848 wrote to memory of 1836	1848	rundll32.exe	14
PID 1848 wrote to memory of 1836	1848	rundll32.exe	14
PID 1848 wrote to memory of 1836	1848	rundll32.exe	14
PID 1848 wrote to memory of 1836	1848	rundll32.exe	14
PID 1848 wrote to memory of 1836	1848	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0c78074cd4eaf0195102ebe4452316cf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848