6e25313ce0d0b1bc1e7826089d4c3406a83c0c3ac1b98173d18353ae1e652bcb

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:30

Target

0bbb6fddade39f98a8ad5d7237411ac4.dll
Size

33KB
MD5

0bbb6fddade39f98a8ad5d7237411ac4
SHA1

1ceabfd81011d36913d42a6778c1c2f0ca021f30
SHA256

6e25313ce0d0b1bc1e7826089d4c3406a83c0c3ac1b98173d18353ae1e652bcb
SHA512

e55df6d82e543340fbccab8b3f72007186fef430bd6662f2697a9ea492a997d9faefd55621eaf61e900098e2505d2995e61b7b68194385580673aa79ffcbc9ed
SSDEEP

384:SV6vS3AcJ1If4zmrrTDxRWt17/3acDHWFsPvQElJhA/hUZ4omX+gvZO5Fy:iGS3A+zuT3Wth/3acD2WP4yQHX+UZOg

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drthte.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\drthte.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	rundll32.exe
Token: SeDebugPrivilege	2280	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2280	1756	rundll32.exe	28
PID 1756 wrote to memory of 2280	1756	rundll32.exe	28
PID 1756 wrote to memory of 2280	1756	rundll32.exe	28
PID 1756 wrote to memory of 2280	1756	rundll32.exe	28
PID 1756 wrote to memory of 2280	1756	rundll32.exe	28
PID 1756 wrote to memory of 2280	1756	rundll32.exe	28
PID 1756 wrote to memory of 2280	1756	rundll32.exe	28
PID 2280 wrote to memory of 1208	2280	rundll32.exe	18
PID 2280 wrote to memory of 1208	2280	rundll32.exe	18

memory/1208-2-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download