55f63f884c8a90f580fa38db668c9a5d72a0f6c1d329e8d9299a62fd2f0e4283

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 12:31

Target

55f63f884c8a90f580fa38db668c9a5d72a0f6c1d329e8d9299a62fd2f0e4283.dll
Size

397KB
MD5

7c92c6e714f8e19ec9cdfb82c4544b58
SHA1

f5f8b7c903c4b42954923235d3f91620ba2f2cb2
SHA256

55f63f884c8a90f580fa38db668c9a5d72a0f6c1d329e8d9299a62fd2f0e4283
SHA512

181368895d48019206c4e765dea69711d0d10219197608c4ec19efd43b1073463aadfc4801ed4a27f5c272efc9240eb07c73f9dbaafd06ecfd8b6ebb34748d06
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaP:174g2LDeiPDImOkx2LIaP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	rundll32.exe
Token: SeTcbPrivilege	2324	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2324	1048	rundll32.exe	28
PID 1048 wrote to memory of 2324	1048	rundll32.exe	28
PID 1048 wrote to memory of 2324	1048	rundll32.exe	28
PID 1048 wrote to memory of 2324	1048	rundll32.exe	28
PID 1048 wrote to memory of 2324	1048	rundll32.exe	28
PID 1048 wrote to memory of 2324	1048	rundll32.exe	28
PID 1048 wrote to memory of 2324	1048	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55f63f884c8a90f580fa38db668c9a5d72a0f6c1d329e8d9299a62fd2f0e4283.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55f63f884c8a90f580fa38db668c9a5d72a0f6c1d329e8d9299a62fd2f0e4283.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324