dbb3a40943114836ae2f000cc5c4d7feffe7341fd221a75a28d39bdfa022096b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 11:25

Target

dbb3a40943114836ae2f000cc5c4d7feffe7341fd221a75a28d39bdfa022096b.dll
Size

397KB
MD5

f5b52ad6218cc77fb052abbbd08b1fd2
SHA1

b7a0583b17c716e55b9c3f10f3b99fdfd5a5cba3
SHA256

dbb3a40943114836ae2f000cc5c4d7feffe7341fd221a75a28d39bdfa022096b
SHA512

4654a2ae5c1eea7af9f51f04c269a8b156e59b303627f52a90b3c6d6cf689de1b36f5e6e318f0f86e55c8cfac66915e53e158e83ae053d977c4b2897679e7485
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa7:174g2LDeiPDImOkx2LIa7

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2280	rundll32.exe
2280	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	rundll32.exe
Token: SeTcbPrivilege	2280	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2280	2120	rundll32.exe	14
PID 2120 wrote to memory of 2280	2120	rundll32.exe	14
PID 2120 wrote to memory of 2280	2120	rundll32.exe	14
PID 2120 wrote to memory of 2280	2120	rundll32.exe	14
PID 2120 wrote to memory of 2280	2120	rundll32.exe	14
PID 2120 wrote to memory of 2280	2120	rundll32.exe	14
PID 2120 wrote to memory of 2280	2120	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dbb3a40943114836ae2f000cc5c4d7feffe7341fd221a75a28d39bdfa022096b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2120