58e07a3d3b1335ef053294525434ec32119d06f1969d5ff3ba049c3f5e1aa412

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:05

Target

04010ac1a35c3c9a77c17d67c51db191.dll
Size

7KB
MD5

04010ac1a35c3c9a77c17d67c51db191
SHA1

c6f59f86ccefaa3c26c82292c9f38afdb47565b4
SHA256

58e07a3d3b1335ef053294525434ec32119d06f1969d5ff3ba049c3f5e1aa412
SHA512

3ac577e7c149a88d5618185a6d2573bcce8afc92771754275933c56a52c55b7b77decd4627f728001a930c327c6b42160464fa6e3b0a04580131609643cf140e
SSDEEP

96:wOfC21FMW3cLJMZiiSBDrMrg12yMrSNxLP8k2ofHZDL2DnC2cBS:b1FMW3c6gPBP7YVrSNxLP0nck

Score

1^/10

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2396	2376	rundll32.exe	16
PID 2376 wrote to memory of 2396	2376	rundll32.exe	16
PID 2376 wrote to memory of 2396	2376	rundll32.exe	16
PID 2376 wrote to memory of 2396	2376	rundll32.exe	16
PID 2376 wrote to memory of 2396	2376	rundll32.exe	16
PID 2376 wrote to memory of 2396	2376	rundll32.exe	16
PID 2376 wrote to memory of 2396	2376	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04010ac1a35c3c9a77c17d67c51db191.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2376

memory/2396-0-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download