8b25c6d58a1c6127a1b016de35f44af4471f2b23ebfc75fe19fdd116d0ecdd16

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:52

Target

0630356e1688c5a73ef7a36b215e31d3.dll
Size

17KB
MD5

0630356e1688c5a73ef7a36b215e31d3
SHA1

444ee84b47e8797e3355a49db7e5095f7f397e6e
SHA256

8b25c6d58a1c6127a1b016de35f44af4471f2b23ebfc75fe19fdd116d0ecdd16
SHA512

3d17d7f01e77486a5ceb8a721410482fb1e679761b1c729c86a9034f3548aa6f348e564525b2e028054fd7f057ce23d452e7281d37705bb4c39a4e31581055dc
SSDEEP

384:0Atziyld3S/W7S3RY72CkzE4ocBmIqxCMbTtcWY1uqAV9:0esW2RfQDcIII5bqW4ul

Score

5^/10

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File created	C:\Windows\SysWOW64\mseion.sys	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 2232	840	rundll32.exe	14
PID 840 wrote to memory of 2232	840	rundll32.exe	14
PID 840 wrote to memory of 2232	840	rundll32.exe	14
PID 840 wrote to memory of 2232	840	rundll32.exe	14
PID 840 wrote to memory of 2232	840	rundll32.exe	14
PID 840 wrote to memory of 2232	840	rundll32.exe	14
PID 840 wrote to memory of 2232	840	rundll32.exe	14
PID 2232 wrote to memory of 1360	2232	rundll32.exe	11

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1360
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0630356e1688c5a73ef7a36b215e31d3.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:840

memory/1360-5-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/2232-1-0x000000000F000000-0x000000000F01B000-memory.dmp

Filesize
108KB

Download
memory/2232-0-0x000000000F000000-0x000000000F01B000-memory.dmp

Filesize
108KB

Download