8eb715203467b043edf434e67b5385002101a6986fc89ab79120e2513677f58e

Analysis

max time kernel
33s
max time network
27s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:15

Target

0832863dacf913518f73e4af42b48545.dll
Size

10KB
MD5

0832863dacf913518f73e4af42b48545
SHA1

32800e0562ab4774fd9d53dc68cc7d1a02a125cd
SHA256

8eb715203467b043edf434e67b5385002101a6986fc89ab79120e2513677f58e
SHA512

9e7cba11b74092d9f7d975496f6086aae36c91cb3a146e3cd6b680e8f4d76d2225b2c1799f1039b5dd50994151e78764a5952b94b664dc798a74a8070c8116dd
SSDEEP

192:8L33pespvP7BB6NmbAiKQJluPEQAFYbTILsa1Skpx0vGuJDgzwsyKLTkgUw9o:czvP7BXKEleEbGbMLsKx0vRUClz

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2784	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2784	2828	rundll32.exe	29
PID 2828 wrote to memory of 2784	2828	rundll32.exe	29
PID 2828 wrote to memory of 2784	2828	rundll32.exe	29
PID 2828 wrote to memory of 2784	2828	rundll32.exe	29
PID 2828 wrote to memory of 2784	2828	rundll32.exe	29
PID 2828 wrote to memory of 2784	2828	rundll32.exe	29
PID 2828 wrote to memory of 2784	2828	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0832863dacf913518f73e4af42b48545.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0832863dacf913518f73e4af42b48545.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2784

memory/2784-0-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download