ba48a2db4f7a3e86f5aa0e0707a664b8a4b69e9dd61e4fb299eae30cac8a3ba3

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:24

Target

ba48a2db4f7a3e86f5aa0e0707a664b8a4b69e9dd61e4fb299eae30cac8a3ba3.dll
Size

397KB
MD5

104835800ecdf68a1043c9c0351d709a
SHA1

45ccdf6e0548feff52c3d546cb20455d122049d6
SHA256

ba48a2db4f7a3e86f5aa0e0707a664b8a4b69e9dd61e4fb299eae30cac8a3ba3
SHA512

da7ae1c800d1ccb71e583adc84339ad42928c19e337df93af079e4cb797656989cbb062f6fe43d285aa0b7f8881f04216f115b33f08e25d8c4a6a0a10e209412
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa5:174g2LDeiPDImOkx2LIa5

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	rundll32.exe
Token: SeTcbPrivilege	2024	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2024	1752	rundll32.exe	28
PID 1752 wrote to memory of 2024	1752	rundll32.exe	28
PID 1752 wrote to memory of 2024	1752	rundll32.exe	28
PID 1752 wrote to memory of 2024	1752	rundll32.exe	28
PID 1752 wrote to memory of 2024	1752	rundll32.exe	28
PID 1752 wrote to memory of 2024	1752	rundll32.exe	28
PID 1752 wrote to memory of 2024	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba48a2db4f7a3e86f5aa0e0707a664b8a4b69e9dd61e4fb299eae30cac8a3ba3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ba48a2db4f7a3e86f5aa0e0707a664b8a4b69e9dd61e4fb299eae30cac8a3ba3.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2024