8add755025ed83a4a41f962a3ae972cb7b26f508ee600493a58b8f1c06423462

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 11:14

Target

19fd45302a3f0fcb7b6c51f0c0576583.dll
Size

178KB
MD5

19fd45302a3f0fcb7b6c51f0c0576583
SHA1

9267562835ce0ba874227fe74be48d59061e92f8
SHA256

8add755025ed83a4a41f962a3ae972cb7b26f508ee600493a58b8f1c06423462
SHA512

48b2b8976005fc082c2556b660211df951281de5deb4da2bc10430473a265de82e857d6afc211aca7a969a2d8730c50eb895270efc504a96829b1bf9e4953b7b
SSDEEP

3072:MTePGNMApUT7fS4NmSDQf3B/CAOAvcxP3wXPlA3pKLX6wbS+6NGxht91:+ePfN/0ongXdAZibIE

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1664	1972	rundll32.exe	28
PID 1972 wrote to memory of 1664	1972	rundll32.exe	28
PID 1972 wrote to memory of 1664	1972	rundll32.exe	28
PID 1972 wrote to memory of 1664	1972	rundll32.exe	28
PID 1972 wrote to memory of 1664	1972	rundll32.exe	28
PID 1972 wrote to memory of 1664	1972	rundll32.exe	28
PID 1972 wrote to memory of 1664	1972	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\19fd45302a3f0fcb7b6c51f0c0576583.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\19fd45302a3f0fcb7b6c51f0c0576583.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1664

memory/1664-0-0x0000000000180000-0x00000000001B1000-memory.dmp

Filesize
196KB

Download