92f117bebb5a80dbc94c5e4813ae22b83ee9eb616200cd221b5e83c905d3e93e

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 10:20

Target

92f117bebb5a80dbc94c5e4813ae22b83ee9eb616200cd221b5e83c905d3e93e.dll
Size

397KB
MD5

9f445d3dfde1f07f4c424a153ca748db
SHA1

25615e143f060c85735a16dcc3c732130b15714a
SHA256

92f117bebb5a80dbc94c5e4813ae22b83ee9eb616200cd221b5e83c905d3e93e
SHA512

fafe1db22e89fc9fbaec80fdaeae53e7961e6532c35f2f9f54fa35540aea0f12d50d2031d63dfb661014f1d0c7a899311cd375a7a8207e53f903835f7072f453
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaH:174g2LDeiPDImOkx2LIaH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	rundll32.exe
Token: SeTcbPrivilege	1504	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1504	2336	rundll32.exe	15
PID 2336 wrote to memory of 1504	2336	rundll32.exe	15
PID 2336 wrote to memory of 1504	2336	rundll32.exe	15
PID 2336 wrote to memory of 1504	2336	rundll32.exe	15
PID 2336 wrote to memory of 1504	2336	rundll32.exe	15
PID 2336 wrote to memory of 1504	2336	rundll32.exe	15
PID 2336 wrote to memory of 1504	2336	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\92f117bebb5a80dbc94c5e4813ae22b83ee9eb616200cd221b5e83c905d3e93e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\92f117bebb5a80dbc94c5e4813ae22b83ee9eb616200cd221b5e83c905d3e93e.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504