616415e9b7a2ed2d37d69d8a669c3465bac2e4722fbd00858372d4136184a22d

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:43

Target

616415e9b7a2ed2d37d69d8a669c3465bac2e4722fbd00858372d4136184a22d.dll
Size

397KB
MD5

e1ab52defbc695c191eae0ffbf216b0b
SHA1

39f903249cba8f6b44f619446524968de519b528
SHA256

616415e9b7a2ed2d37d69d8a669c3465bac2e4722fbd00858372d4136184a22d
SHA512

23ad685ae31e930d9839ebe41c3a0e376efe4df5636b69f1234cf22b4e5950deacd650cc18d95317559b5b99bfe11ff76640bb96dcf40cc99a342b072983c2a2
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa+:174g2LDeiPDImOkx2LIa+

Score

1^/10

Suspicious behavior: EnumeratesProcesses 7 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	rundll32.exe
Token: SeTcbPrivilege	2144	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2144	1200	rundll32.exe	28
PID 1200 wrote to memory of 2144	1200	rundll32.exe	28
PID 1200 wrote to memory of 2144	1200	rundll32.exe	28
PID 1200 wrote to memory of 2144	1200	rundll32.exe	28
PID 1200 wrote to memory of 2144	1200	rundll32.exe	28
PID 1200 wrote to memory of 2144	1200	rundll32.exe	28
PID 1200 wrote to memory of 2144	1200	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\616415e9b7a2ed2d37d69d8a669c3465bac2e4722fbd00858372d4136184a22d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\616415e9b7a2ed2d37d69d8a669c3465bac2e4722fbd00858372d4136184a22d.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2144