3b508a21fa9d7bf87e481ff4e62799883f033341a54fdb45e9c6dd186dcec667

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 22:44

Target

fd9b5ba3c0ec1addb25e9ed90638b427.dll
Size

35KB
MD5

fd9b5ba3c0ec1addb25e9ed90638b427
SHA1

ad4533c81f1d495ea008a75693a927af2a2e241d
SHA256

3b508a21fa9d7bf87e481ff4e62799883f033341a54fdb45e9c6dd186dcec667
SHA512

b229d861e88a34b22590e89c213905393aece710366abce1938f2ada459cec49a500f4669c593bfad7ae79218a5052cf0ef9c715b010e7626ee5892705d07497
SSDEEP

768:ZgXwxTQzLfccFKJNCoPDqMugaTeHaenMgWUzPXdWyH+zOly3+I+zEui:ZggCzLUJfDtDNHacMgWU5WyH+0y3+lz

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	rundll32.exe
Token: SeTakeOwnershipPrivilege	1988	rundll32.exe
Token: SeImpersonatePrivilege	1988	rundll32.exe
Token: SeAssignPrimaryTokenPrivilege	1988	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1988	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 1988	2156	rundll32.exe	28
PID 2156 wrote to memory of 1988	2156	rundll32.exe	28
PID 2156 wrote to memory of 1988	2156	rundll32.exe	28
PID 2156 wrote to memory of 1988	2156	rundll32.exe	28
PID 2156 wrote to memory of 1988	2156	rundll32.exe	28
PID 2156 wrote to memory of 1988	2156	rundll32.exe	28
PID 2156 wrote to memory of 1988	2156	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd9b5ba3c0ec1addb25e9ed90638b427.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd9b5ba3c0ec1addb25e9ed90638b427.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1988

memory/1988-0-0x0000000000180000-0x0000000000183000-memory.dmp

Filesize
12KB

Download
memory/1988-1-0x00000000000C0000-0x00000000000CD000-memory.dmp

Filesize
52KB

Download
memory/1988-2-0x0000000000180000-0x0000000000182000-memory.dmp

Filesize
8KB

Download