3c4ceee9eb970ed22878d784e21bbd6f564cced7f9db5ee5b94096a0451ee722

Analysis

max time kernel
62s
max time network
26s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 08:44

Target

3c4ceee9eb970ed22878d784e21bbd6f564cced7f9db5ee5b94096a0451ee722.dll
Size

397KB
MD5

ea06172ab253123170ddbf351d6bb5aa
SHA1

71aa6198d3725ae33a803836304c59cbc67b345b
SHA256

3c4ceee9eb970ed22878d784e21bbd6f564cced7f9db5ee5b94096a0451ee722
SHA512

01b1502bff006eb91940f82b883d8c64a3eace2ed9dbc77111a765cdaebbf6895655e7ea67a7d6ed79a794172a8352e78e1c5d0ce4dfc6edeb32c04530f0b999
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaM:174g2LDeiPDImOkx2LIaM

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	rundll32.exe
Token: SeTcbPrivilege	2640	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2640	2864	rundll32.exe	29
PID 2864 wrote to memory of 2640	2864	rundll32.exe	29
PID 2864 wrote to memory of 2640	2864	rundll32.exe	29
PID 2864 wrote to memory of 2640	2864	rundll32.exe	29
PID 2864 wrote to memory of 2640	2864	rundll32.exe	29
PID 2864 wrote to memory of 2640	2864	rundll32.exe	29
PID 2864 wrote to memory of 2640	2864	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c4ceee9eb970ed22878d784e21bbd6f564cced7f9db5ee5b94096a0451ee722.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c4ceee9eb970ed22878d784e21bbd6f564cced7f9db5ee5b94096a0451ee722.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640