9d45afefad846a34f15daffaed3dba7f8791d12a42d643173489b575a937808e

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:02

Target

2c969a36f18e9c62a50f30c2c80b8525.dll
Size

169KB
MD5

2c969a36f18e9c62a50f30c2c80b8525
SHA1

97f14230aa3e461bc5e4494a0ca359dfc1dcbadd
SHA256

9d45afefad846a34f15daffaed3dba7f8791d12a42d643173489b575a937808e
SHA512

7ca7560d49b29893aef425867e226d09dcdffa96b6818e8d86f539cc8deebd338a98f5413442d5460492160291bf6620bf669c1e1dabe26439917ccec45b7a64
SSDEEP

3072:sDtb+l46QACi9dUghrL2lvQjGoCtf4paWS2xLusQFaOx:sh6l4zAP9dPhrLNctQpaWXusQFaO

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\expleror.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\expleror.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2488	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	rundll32.exe
Token: SeDebugPrivilege	2488	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2488	2056	rundll32.exe	14
PID 2056 wrote to memory of 2488	2056	rundll32.exe	14
PID 2056 wrote to memory of 2488	2056	rundll32.exe	14
PID 2056 wrote to memory of 2488	2056	rundll32.exe	14
PID 2056 wrote to memory of 2488	2056	rundll32.exe	14
PID 2056 wrote to memory of 2488	2056	rundll32.exe	14
PID 2056 wrote to memory of 2488	2056	rundll32.exe	14
PID 2488 wrote to memory of 420	2488	rundll32.exe	2

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c969a36f18e9c62a50f30c2c80b8525.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2056

memory/420-6-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

Filesize
4KB

Download
memory/2488-0-0x00000000000B0000-0x00000000000E0000-memory.dmp

Filesize
192KB

Download
memory/2488-4-0x00000000000B0000-0x00000000000E0000-memory.dmp

Filesize
192KB

Download
memory/2488-3-0x00000000000A0000-0x00000000000D0000-memory.dmp

Filesize
192KB

Download
memory/2488-2-0x00000000000A0000-0x00000000000D0000-memory.dmp

Filesize
192KB

Download
memory/2488-1-0x00000000000A0000-0x00000000000D0000-memory.dmp

Filesize
192KB

Download