b90270464f470a9ec57e4ab38db32c8ce2e24aea9fb50beaed2afdfcf344ab2b

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 00:18

Target

4248bae90f709eb918af071c251009cd.dll
Size

12KB
MD5

4248bae90f709eb918af071c251009cd
SHA1

53d685091d0a1c1108bca0579c8d582a252f9786
SHA256

b90270464f470a9ec57e4ab38db32c8ce2e24aea9fb50beaed2afdfcf344ab2b
SHA512

c461ca9f074c6ee1b64060bef4736e35f7e8c546260478c2fa7d2825e3735030f5378a74b633636d37f18ff0819287c81105a62f5dd1360837147ba7e0b3847b
SSDEEP

192:jl706uPinf5qmXkN5Cib5ruhSUgDf+DQsZSKZGDoRGb1XaWVjhV7DmQFp7FUkgU1:jlA6myplBhSU+d0S5cGb13HD11

Score

1^/10

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2208	1152	rundll32.exe	28
PID 1152 wrote to memory of 2208	1152	rundll32.exe	28
PID 1152 wrote to memory of 2208	1152	rundll32.exe	28
PID 1152 wrote to memory of 2208	1152	rundll32.exe	28
PID 1152 wrote to memory of 2208	1152	rundll32.exe	28
PID 1152 wrote to memory of 2208	1152	rundll32.exe	28
PID 1152 wrote to memory of 2208	1152	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4248bae90f709eb918af071c251009cd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4248bae90f709eb918af071c251009cd.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2208

memory/2208-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download
memory/2208-1-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download