3c6590255ace6b141ff8e03156174433a0b5ec8c394c2e62d15eacbb49d69a8b

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 13:41

Target

3c6590255ace6b141ff8e03156174433a0b5ec8c394c2e62d15eacbb49d69a8b.dll
Size

397KB
MD5

1263b72e0b9a07e2b63ac23009211d9b
SHA1

c27a852523d50df8c9b128ae386775b8682108f2
SHA256

3c6590255ace6b141ff8e03156174433a0b5ec8c394c2e62d15eacbb49d69a8b
SHA512

332585ce082f15decc5fe0af935a34c6bd6d365c78d21b1bc94094468e6bcd09ae47c441cbd1e37ac49bddf257a5b1ce7c47934255fae1083fc3bd7ed55fda41
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaS:174g2LDeiPDImOkx2LIaS

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1344	rundll32.exe
1344	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1344	rundll32.exe
Token: SeTcbPrivilege	1344	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1344	1732	rundll32.exe	28
PID 1732 wrote to memory of 1344	1732	rundll32.exe	28
PID 1732 wrote to memory of 1344	1732	rundll32.exe	28
PID 1732 wrote to memory of 1344	1732	rundll32.exe	28
PID 1732 wrote to memory of 1344	1732	rundll32.exe	28
PID 1732 wrote to memory of 1344	1732	rundll32.exe	28
PID 1732 wrote to memory of 1344	1732	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c6590255ace6b141ff8e03156174433a0b5ec8c394c2e62d15eacbb49d69a8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3c6590255ace6b141ff8e03156174433a0b5ec8c394c2e62d15eacbb49d69a8b.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344