fe840c40c99a8f42f1fdf25e67836793e881b3f71652d90bc0faea4e315c1d50

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:13

Target

fe840c40c99a8f42f1fdf25e67836793e881b3f71652d90bc0faea4e315c1d50.dll
Size

397KB
MD5

54c6d174ce8807e4cda740584c75d73a
SHA1

b0e717190b0aa7a92f101c38aadc1fcc8375bc01
SHA256

fe840c40c99a8f42f1fdf25e67836793e881b3f71652d90bc0faea4e315c1d50
SHA512

24620df79facd6c7873b4b32eb1cf3ef928407a19b2d40283f853629f3886587dff9572150c06da6f865a60c40dc854c8fdd3db8791b39bd09ea630063c41ec3
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaq:174g2LDeiPDImOkx2LIaq

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1704	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1704	1580	rundll32.exe	28
PID 1580 wrote to memory of 1704	1580	rundll32.exe	28
PID 1580 wrote to memory of 1704	1580	rundll32.exe	28
PID 1580 wrote to memory of 1704	1580	rundll32.exe	28
PID 1580 wrote to memory of 1704	1580	rundll32.exe	28
PID 1580 wrote to memory of 1704	1580	rundll32.exe	28
PID 1580 wrote to memory of 1704	1580	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe840c40c99a8f42f1fdf25e67836793e881b3f71652d90bc0faea4e315c1d50.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fe840c40c99a8f42f1fdf25e67836793e881b3f71652d90bc0faea4e315c1d50.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1704