91e648802f16bb72c252d8ee8d3517020169b6d880fec3ba8a50901b888128cc

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 11:09

Target

91e648802f16bb72c252d8ee8d3517020169b6d880fec3ba8a50901b888128cc.dll
Size

397KB
MD5

fad353cd8b82de37237dfaad29ee202e
SHA1

75a7aebb59696909f3097967a66100464ea900c2
SHA256

91e648802f16bb72c252d8ee8d3517020169b6d880fec3ba8a50901b888128cc
SHA512

9baf12445e1baa4ea695d3722a0b32bae09b57b0f812752b936b8f126186b13a4de90ed4f83a7e9593ec2ab5406637004aef9aabc53a19d95ce35f0d5db99fb6
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOag:174g2LDeiPDImOkx2LIag

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2320	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	rundll32.exe
Token: SeTcbPrivilege	2320	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2320	2868	rundll32.exe	16
PID 2868 wrote to memory of 2320	2868	rundll32.exe	16
PID 2868 wrote to memory of 2320	2868	rundll32.exe	16
PID 2868 wrote to memory of 2320	2868	rundll32.exe	16
PID 2868 wrote to memory of 2320	2868	rundll32.exe	16
PID 2868 wrote to memory of 2320	2868	rundll32.exe	16
PID 2868 wrote to memory of 2320	2868	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\91e648802f16bb72c252d8ee8d3517020169b6d880fec3ba8a50901b888128cc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868