c10d67ebaeeea80e2a0cb268093a94f9db17d3b017b907af9934c9d520e59300

Analysis

max time kernel
117s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 21:04

Target

1c6edb44951b69ef3d0058acb650c03a.dll
Size

27KB
MD5

1c6edb44951b69ef3d0058acb650c03a
SHA1

307759db86699064e49e61ee42be37841b47bc88
SHA256

c10d67ebaeeea80e2a0cb268093a94f9db17d3b017b907af9934c9d520e59300
SHA512

419410524f48dd460588ab498aed726a122b1777e35a432026487aa6a16af9c1c4f9f65a57c745f3ff416e06bb8b9b33d2d36bf2ed5806a2741a864301c204d7
SSDEEP

384:Jt3x2xRplGg13x2xQfcNUi/Yzixt+oBUb0d+nW9u7PqS1:CbGgnfWUi2lg+nWUDn1

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 2240	1424	rundll32.exe	28
PID 1424 wrote to memory of 2240	1424	rundll32.exe	28
PID 1424 wrote to memory of 2240	1424	rundll32.exe	28
PID 1424 wrote to memory of 2240	1424	rundll32.exe	28
PID 1424 wrote to memory of 2240	1424	rundll32.exe	28
PID 1424 wrote to memory of 2240	1424	rundll32.exe	28
PID 1424 wrote to memory of 2240	1424	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c6edb44951b69ef3d0058acb650c03a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1c6edb44951b69ef3d0058acb650c03a.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2240

memory/2240-1-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2240-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download