627c9903bc9d0dacc325b03c7580a3cad22f8d95308e2e1dfdaf2db9426ff0bb

Analysis

max time kernel
186s
max time network
190s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:38

Target

04a0220134a86e5086fc18cce31dbd33.dll
Size

162KB
MD5

04a0220134a86e5086fc18cce31dbd33
SHA1

0aa29a4a793610ecbbbb10db9ac896cab65f5e4a
SHA256

627c9903bc9d0dacc325b03c7580a3cad22f8d95308e2e1dfdaf2db9426ff0bb
SHA512

0f725164d023880a4eaa601a6043f87f119d66b2b257efcf7e021d665e2115dc5538a5edb58e5c25d7ed9d274a5fd1d2a2ee5bbd7272b8dfa218193fc2fb8db2
SSDEEP

3072:3EZB94/pzXckR9TsCz8fjfkjJmh02zW7GDkHxIswAA:3GABzMg9ngQ1mh07ywItAA

Score

8^/10

Blocklisted process makes network request 5 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	rundll32.exe
Token: SeDebugPrivilege	2684	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2684	2840	rundll32.exe	17
PID 2840 wrote to memory of 2684	2840	rundll32.exe	17
PID 2840 wrote to memory of 2684	2840	rundll32.exe	17
PID 2840 wrote to memory of 2684	2840	rundll32.exe	17
PID 2840 wrote to memory of 2684	2840	rundll32.exe	17
PID 2840 wrote to memory of 2684	2840	rundll32.exe	17
PID 2840 wrote to memory of 2684	2840	rundll32.exe	17

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04a0220134a86e5086fc18cce31dbd33.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04a0220134a86e5086fc18cce31dbd33.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:2684

memory/2684-0-0x0000000000120000-0x000000000014E000-memory.dmp

Filesize
184KB

Download
memory/2684-1-0x0000000000120000-0x000000000014E000-memory.dmp

Filesize
184KB

Download
memory/2684-3-0x0000000000120000-0x000000000014E000-memory.dmp

Filesize
184KB

Download
memory/2684-4-0x0000000000120000-0x000000000014E000-memory.dmp

Filesize
184KB

Download
memory/2684-6-0x0000000000120000-0x000000000014E000-memory.dmp

Filesize
184KB

Download
memory/2684-7-0x0000000000120000-0x000000000014E000-memory.dmp

Filesize
184KB

Download
memory/2684-9-0x0000000000120000-0x000000000014E000-memory.dmp

Filesize
184KB

Download
memory/2684-10-0x0000000000120000-0x000000000014E000-memory.dmp

Filesize
184KB

Download
memory/2684-12-0x0000000000120000-0x000000000014E000-memory.dmp

Filesize
184KB

Download
memory/2684-13-0x0000000000120000-0x000000000014E000-memory.dmp

Filesize
184KB

Download