221180eb78bbff295293f7f158eb77a95bfd916ed464b389b02d41a2a60a6754

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 11:59

Target

221180eb78bbff295293f7f158eb77a95bfd916ed464b389b02d41a2a60a6754.dll
Size

397KB
MD5

53daf2bd9352dfd392c6ddd74c06ebff
SHA1

cbf4a49db76f81405450cf30888e6c36e66a8fb2
SHA256

221180eb78bbff295293f7f158eb77a95bfd916ed464b389b02d41a2a60a6754
SHA512

6198b884209416b551027fc81ea1d6446b2d286a18fe11b446e75c8856835cf405ada6ad8fbc0633128b48e836656f9d6f1f8d1d503a084324b079c8e0fb8f78
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaI:174g2LDeiPDImOkx2LIaI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	rundll32.exe
Token: SeTcbPrivilege	1676	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1676	1200	rundll32.exe	18
PID 1200 wrote to memory of 1676	1200	rundll32.exe	18
PID 1200 wrote to memory of 1676	1200	rundll32.exe	18
PID 1200 wrote to memory of 1676	1200	rundll32.exe	18
PID 1200 wrote to memory of 1676	1200	rundll32.exe	18
PID 1200 wrote to memory of 1676	1200	rundll32.exe	18
PID 1200 wrote to memory of 1676	1200	rundll32.exe	18

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\221180eb78bbff295293f7f158eb77a95bfd916ed464b389b02d41a2a60a6754.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\221180eb78bbff295293f7f158eb77a95bfd916ed464b389b02d41a2a60a6754.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676