8c5553f616c378310882872f2a9fc7af7b0a5c23f66e448e1298a42090ab4c3b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:55

Target

8c5553f616c378310882872f2a9fc7af7b0a5c23f66e448e1298a42090ab4c3b.dll
Size

397KB
MD5

baae1296c164e6500a6523b80ddb34f0
SHA1

7db533da5369ae69c047a8ef2d7fd2f42c68fd7d
SHA256

8c5553f616c378310882872f2a9fc7af7b0a5c23f66e448e1298a42090ab4c3b
SHA512

297e643d907ebc21a8f097cf8c8104c8b59b36f6259e638c46c68cdabaccf2a574ac4713c00a581dcf948705cb51eb39284c04fecdfab9aa8fe9dd2e8303e601
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaW:174g2LDeiPDImOkx2LIaW

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	rundll32.exe
Token: SeTcbPrivilege	3028	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28
PID 1652 wrote to memory of 3028	1652	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5553f616c378310882872f2a9fc7af7b0a5c23f66e448e1298a42090ab4c3b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8c5553f616c378310882872f2a9fc7af7b0a5c23f66e448e1298a42090ab4c3b.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028