29b68a6fb578ead8872c6fb5a69f7a1c5c377577d8b13a3a61cf14753e3c9966

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:07

Target

13e30e6dc99edf4c823873505fcc108c.dll
Size

140KB
MD5

13e30e6dc99edf4c823873505fcc108c
SHA1

78ea5b58e2cbe146df076cfcda75288ce2f1f9fa
SHA256

29b68a6fb578ead8872c6fb5a69f7a1c5c377577d8b13a3a61cf14753e3c9966
SHA512

41d4f380bd60bcb37847011b9888527c31c328db9e85dc0f40add66f3f7eb4f2ee2eb82a1a042088a57e88ddb7ac06ca5c6f3d4250c1490c5bf2af16b0e61912
SSDEEP

3072:O3IPnKm0+7EFnnpJfWs+Vtt7aqcIe7HCjxUW99/1J5rUtbN:OoK5+7Ehf/+VjncHCP3bp

Score

4^/10

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~3\c801ccf505378328c4fde99cd6e03e31.pad	rundll32.exe
File created	C:\PROGRA~3\c801ccf505378328c4fde99cd6e03e31.pad	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2444	1732	rundll32.exe	28
PID 1732 wrote to memory of 2444	1732	rundll32.exe	28
PID 1732 wrote to memory of 2444	1732	rundll32.exe	28
PID 1732 wrote to memory of 2444	1732	rundll32.exe	28
PID 1732 wrote to memory of 2444	1732	rundll32.exe	28
PID 1732 wrote to memory of 2444	1732	rundll32.exe	28
PID 1732 wrote to memory of 2444	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13e30e6dc99edf4c823873505fcc108c.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\13e30e6dc99edf4c823873505fcc108c.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2444

memory/2444-0-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download
memory/2444-3-0x0000000010000000-0x0000000010073000-memory.dmp

Filesize
460KB

Download