e5b826256ab923b4395c8dcfe66e06bff8f395c93733127deb019f4faacca567

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:23

Target

0cd7f40a1519f7228157f4b71b24acd9.dll
Size

432KB
MD5

0cd7f40a1519f7228157f4b71b24acd9
SHA1

559d65d98627df83a379e51e3b1a61ff8a5311cd
SHA256

e5b826256ab923b4395c8dcfe66e06bff8f395c93733127deb019f4faacca567
SHA512

e4e6c9b0f3f192eb14bb47a3638e7b9b7bcdcf65b4fdff20d21ecc30ff8e98a802975953c7a01461c4f7ee03b115880ce98edf3fd70d4957e8bec03e4a00f65c
SSDEEP

6144:SW4oPJqMOqjU0XF2idZecnl20lHRxp3gOe0M6E81xS0WcHpsFbBqt:ioRPOqjU6F3Z4mxx80MHoTAFbi

Score

8^/10

Blocklisted process makes network request 4 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2156	2164	rundll32.exe	28
PID 2164 wrote to memory of 2156	2164	rundll32.exe	28
PID 2164 wrote to memory of 2156	2164	rundll32.exe	28
PID 2164 wrote to memory of 2156	2164	rundll32.exe	28
PID 2164 wrote to memory of 2156	2164	rundll32.exe	28
PID 2164 wrote to memory of 2156	2164	rundll32.exe	28
PID 2164 wrote to memory of 2156	2164	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cd7f40a1519f7228157f4b71b24acd9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cd7f40a1519f7228157f4b71b24acd9.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of AdjustPrivilegeToken
  PID:2156

memory/2156-0-0x00000000004C0000-0x0000000000569000-memory.dmp

Filesize
676KB

Download
memory/2156-1-0x00000000004C0000-0x0000000000569000-memory.dmp

Filesize
676KB

Download
memory/2156-2-0x00000000004C0000-0x0000000000569000-memory.dmp

Filesize
676KB

Download
memory/2156-3-0x00000000004C0000-0x0000000000569000-memory.dmp

Filesize
676KB

Download
memory/2156-7-0x00000000002E0000-0x0000000000334000-memory.dmp

Filesize
336KB

Download
memory/2156-6-0x00000000004C0000-0x0000000000569000-memory.dmp

Filesize
676KB

Download
memory/2156-5-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/2156-4-0x0000000003400000-0x0000000003402000-memory.dmp

Filesize
8KB

Download
memory/2156-8-0x00000000004C0000-0x0000000000569000-memory.dmp

Filesize
676KB

Download
memory/2156-10-0x00000000002E0000-0x0000000000334000-memory.dmp

Filesize
336KB

Download
memory/2156-20-0x00000000004C0000-0x0000000000569000-memory.dmp

Filesize
676KB

Download