aa66e71f875684e592e3fe2cfdeb76a2458222c84a0631abb2f34beb4cddc6f2

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 05:45

Target

2a876089433392e0d56c7352b221da51.dll
Size

46KB
MD5

2a876089433392e0d56c7352b221da51
SHA1

9868ee3f8b5bd898365fc287e750f794573647e9
SHA256

aa66e71f875684e592e3fe2cfdeb76a2458222c84a0631abb2f34beb4cddc6f2
SHA512

2c9a9a4a47c25b9a1036cdeb87f745239badb7c8bc4644c9d66bb2492a5e41eb6c53e4a65ef27755aa799e2b4a988ec513074800f27b4def80674e5fbe9d3e20
SSDEEP

768:0YK9yzLhSl5VMw8+5C0T/71/5L2drX9aUBwLOSo5+icyMFgbw6:03oL0Ho0TDL2RsUWdqu6

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2080	2120	rundll32.exe	16
PID 2120 wrote to memory of 2080	2120	rundll32.exe	16
PID 2120 wrote to memory of 2080	2120	rundll32.exe	16
PID 2120 wrote to memory of 2080	2120	rundll32.exe	16
PID 2120 wrote to memory of 2080	2120	rundll32.exe	16
PID 2120 wrote to memory of 2080	2120	rundll32.exe	16
PID 2120 wrote to memory of 2080	2120	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a876089433392e0d56c7352b221da51.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a876089433392e0d56c7352b221da51.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2080

memory/2080-0-0x0000000000120000-0x0000000000131000-memory.dmp

Filesize
68KB

Download