bd6e348341577f16e843687d87e52da3254b3740723b84d3686c30739b260aae

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 12:06

Target

bd6e348341577f16e843687d87e52da3254b3740723b84d3686c30739b260aae.dll
Size

397KB
MD5

38246c03a147f2211d821b1dcc0ead8c
SHA1

68355530e6c29ff541a5a25fdc898260499a769c
SHA256

bd6e348341577f16e843687d87e52da3254b3740723b84d3686c30739b260aae
SHA512

c1c08aa74c5697f6f8b5c5ea7eb12a693f5684c00f06d02f1e6b7d8a2cf51a1238bb81bfc107689b1b5d2ae1019c0481804b29f5eee2da868e155778a72aae42
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaW:174g2LDeiPDImOkx2LIaW

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	rundll32.exe
Token: SeTcbPrivilege	2180	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2180	1792	rundll32.exe	14
PID 1792 wrote to memory of 2180	1792	rundll32.exe	14
PID 1792 wrote to memory of 2180	1792	rundll32.exe	14
PID 1792 wrote to memory of 2180	1792	rundll32.exe	14
PID 1792 wrote to memory of 2180	1792	rundll32.exe	14
PID 1792 wrote to memory of 2180	1792	rundll32.exe	14
PID 1792 wrote to memory of 2180	1792	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bd6e348341577f16e843687d87e52da3254b3740723b84d3686c30739b260aae.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1792