67a88f48876950bfb2354a4f6d675e9a9755d8b5d5b3a8179bc55a1e7a2c2677

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 22:57

Target

064acb0f7e29378d3cedbb787e8024eb.dll
Size

4KB
MD5

064acb0f7e29378d3cedbb787e8024eb
SHA1

8393a8e40a410088e0d1234cc9b67b0bd71a1365
SHA256

67a88f48876950bfb2354a4f6d675e9a9755d8b5d5b3a8179bc55a1e7a2c2677
SHA512

e2f9dfe35ddef822482a110cf0e56368b1e9461def3c85d42cd7cc10897558ec5f3469034e9ebe9b2b0d2c15de43ade4dd2ea37eabf42ff91d4dc33c17d61d36
SSDEEP

96:WPgNpNSn6ki3Rw878ttkM3lzTXA2KupGjjlkgcwQwTKpDC:WYk61RJmSWlzTZpGXlkgUwuw

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1948	rundll32.exe
1948	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1948	2488	rundll32.exe	28
PID 2488 wrote to memory of 1948	2488	rundll32.exe	28
PID 2488 wrote to memory of 1948	2488	rundll32.exe	28
PID 2488 wrote to memory of 1948	2488	rundll32.exe	28
PID 2488 wrote to memory of 1948	2488	rundll32.exe	28
PID 2488 wrote to memory of 1948	2488	rundll32.exe	28
PID 2488 wrote to memory of 1948	2488	rundll32.exe	28
PID 1948 wrote to memory of 1272	1948	rundll32.exe	16

memory/1272-1-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1948-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download