a598f3bfe6aade6181811e357e6552b2611a077e63d439071e1eae1cbbf551e0

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 12:02

Target

a598f3bfe6aade6181811e357e6552b2611a077e63d439071e1eae1cbbf551e0.dll
Size

397KB
MD5

edb507cba5655fefd204fec5e1e78a90
SHA1

5fc7371b58d8ac572fe42d29b4576eb06cc9b236
SHA256

a598f3bfe6aade6181811e357e6552b2611a077e63d439071e1eae1cbbf551e0
SHA512

1a31d2806438fca05d1cbccde90c5392ffced7e11d67930c60b0ac2b5c88e66335db5a14f3d6f1cc8212b5109d5d5189f96cf019603c571792a847f1435badc6
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOan:174g2LDeiPDImOkx2LIan

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	rundll32.exe
Token: SeTcbPrivilege	1724	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1724	2456	rundll32.exe	28
PID 2456 wrote to memory of 1724	2456	rundll32.exe	28
PID 2456 wrote to memory of 1724	2456	rundll32.exe	28
PID 2456 wrote to memory of 1724	2456	rundll32.exe	28
PID 2456 wrote to memory of 1724	2456	rundll32.exe	28
PID 2456 wrote to memory of 1724	2456	rundll32.exe	28
PID 2456 wrote to memory of 1724	2456	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a598f3bfe6aade6181811e357e6552b2611a077e63d439071e1eae1cbbf551e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a598f3bfe6aade6181811e357e6552b2611a077e63d439071e1eae1cbbf551e0.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724