1e68059f6b0257037fb0e515f2594ef1fbaf5b5c9ca766b3d611be17a50ab7a5

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 12:29

Target

1e68059f6b0257037fb0e515f2594ef1fbaf5b5c9ca766b3d611be17a50ab7a5.dll
Size

397KB
MD5

b53c4b16d296e0d80828d48c8da59ee6
SHA1

ed5897f89c091539ad4d2e9901d7606783ff1e63
SHA256

1e68059f6b0257037fb0e515f2594ef1fbaf5b5c9ca766b3d611be17a50ab7a5
SHA512

44e5f70745038259e7303871e8f567042ee4e514c35c3927553bf57733f1fd8bda738fc3066d7fe6898cf08a7a4702eb7060f571a6a7004c570c175eebb0992c
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaU:174g2LDeiPDImOkx2LIaU

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	rundll32.exe
Token: SeTcbPrivilege	1384	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 1384	1620	rundll32.exe	19
PID 1620 wrote to memory of 1384	1620	rundll32.exe	19
PID 1620 wrote to memory of 1384	1620	rundll32.exe	19
PID 1620 wrote to memory of 1384	1620	rundll32.exe	19
PID 1620 wrote to memory of 1384	1620	rundll32.exe	19
PID 1620 wrote to memory of 1384	1620	rundll32.exe	19
PID 1620 wrote to memory of 1384	1620	rundll32.exe	19

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e68059f6b0257037fb0e515f2594ef1fbaf5b5c9ca766b3d611be17a50ab7a5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1e68059f6b0257037fb0e515f2594ef1fbaf5b5c9ca766b3d611be17a50ab7a5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1384