4f7aada6a7becccda2e2f1b115ac67dadd8738a487e41af75ca1fe6490b7bd29

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 12:15

Target

4f7aada6a7becccda2e2f1b115ac67dadd8738a487e41af75ca1fe6490b7bd29.dll
Size

397KB
MD5

aba415fb22291aba726f036801921ea9
SHA1

4611a6bf05e3c9527b24815ff8517a50774f2e9b
SHA256

4f7aada6a7becccda2e2f1b115ac67dadd8738a487e41af75ca1fe6490b7bd29
SHA512

92118536f5a4a63e1eb0a9a992d478e375410144627ea5ea7768b34249cc519885e5a3809f055603130f5157706c73e29e2171c7938d620f3e306218c448ca52
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOay:174g2LDeiPDImOkx2LIay

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	rundll32.exe
Token: SeTcbPrivilege	1752	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1752	1720	rundll32.exe	14
PID 1720 wrote to memory of 1752	1720	rundll32.exe	14
PID 1720 wrote to memory of 1752	1720	rundll32.exe	14
PID 1720 wrote to memory of 1752	1720	rundll32.exe	14
PID 1720 wrote to memory of 1752	1720	rundll32.exe	14
PID 1720 wrote to memory of 1752	1720	rundll32.exe	14
PID 1720 wrote to memory of 1752	1720	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f7aada6a7becccda2e2f1b115ac67dadd8738a487e41af75ca1fe6490b7bd29.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1720