eda697a7ad0f4adb46993abff6c22b14647eee0f4acdd1628eeabca01dca7269

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 13:24

Target

eda697a7ad0f4adb46993abff6c22b14647eee0f4acdd1628eeabca01dca7269.dll
Size

397KB
MD5

deac93129410642ea7d5aa8c7c830862
SHA1

4bda2336e0f4d4a1c074ebc1752051e5eb7ad246
SHA256

eda697a7ad0f4adb46993abff6c22b14647eee0f4acdd1628eeabca01dca7269
SHA512

1f1daa62e748e376abdbfdedaaca908ec3495621990747873eeb774f6c3c414340a4c1f4547a3e7fc339b659e1348b7ab07fdb166a659f40d77a8ee350ae5eeb
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOag:174g2LDeiPDImOkx2LIag

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	rundll32.exe
Token: SeTcbPrivilege	2328	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2328	2356	rundll32.exe	14
PID 2356 wrote to memory of 2328	2356	rundll32.exe	14
PID 2356 wrote to memory of 2328	2356	rundll32.exe	14
PID 2356 wrote to memory of 2328	2356	rundll32.exe	14
PID 2356 wrote to memory of 2328	2356	rundll32.exe	14
PID 2356 wrote to memory of 2328	2356	rundll32.exe	14
PID 2356 wrote to memory of 2328	2356	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\eda697a7ad0f4adb46993abff6c22b14647eee0f4acdd1628eeabca01dca7269.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2356