fdf53fd799ec47b61a028b31948b9be56dba23b0be118e00543688629aad9199

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 12:22

Target

fdf53fd799ec47b61a028b31948b9be56dba23b0be118e00543688629aad9199.dll
Size

397KB
MD5

6e7f893d49c3210005d6fde845a8fcee
SHA1

d21abf30b9571e4e13e4003b0d3b1ff6121db0c1
SHA256

fdf53fd799ec47b61a028b31948b9be56dba23b0be118e00543688629aad9199
SHA512

26348d68ef6d4e5f1aeec2fcc529c2d1552d4c895786a9a00c7c594ac6b89ed9b2d1e8f6cf1964d7f5ffedc96f86083f7dc02318eff54a293b124ce7beebf834
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaz:174g2LDeiPDImOkx2LIaz

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	rundll32.exe
Token: SeTcbPrivilege	3000	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 3000	2656	rundll32.exe	16
PID 2656 wrote to memory of 3000	2656	rundll32.exe	16
PID 2656 wrote to memory of 3000	2656	rundll32.exe	16
PID 2656 wrote to memory of 3000	2656	rundll32.exe	16
PID 2656 wrote to memory of 3000	2656	rundll32.exe	16
PID 2656 wrote to memory of 3000	2656	rundll32.exe	16
PID 2656 wrote to memory of 3000	2656	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdf53fd799ec47b61a028b31948b9be56dba23b0be118e00543688629aad9199.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdf53fd799ec47b61a028b31948b9be56dba23b0be118e00543688629aad9199.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000