2b03c2fe6f1b8573e1c65e28424f4c5a9eb382a7216ea174449422714b5b9d98

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 12:06

Target

2b03c2fe6f1b8573e1c65e28424f4c5a9eb382a7216ea174449422714b5b9d98.dll
Size

397KB
MD5

fdec01232ba11f6209efae956a2a193c
SHA1

4b870e7f3322b27cb3dc5a993fd6353641fb78ef
SHA256

2b03c2fe6f1b8573e1c65e28424f4c5a9eb382a7216ea174449422714b5b9d98
SHA512

5011e007dd21d3ddf97e35796c67cbeeb3514d4082cc3a72f8e5bfbc34e8889b7e98957299b2d6e47af2d6318e886101794f10901d1a5927295861dc6489c3d9
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOay:174g2LDeiPDImOkx2LIay

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	rundll32.exe
Token: SeTcbPrivilege	912	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 912	824	rundll32.exe	14
PID 824 wrote to memory of 912	824	rundll32.exe	14
PID 824 wrote to memory of 912	824	rundll32.exe	14
PID 824 wrote to memory of 912	824	rundll32.exe	14
PID 824 wrote to memory of 912	824	rundll32.exe	14
PID 824 wrote to memory of 912	824	rundll32.exe	14
PID 824 wrote to memory of 912	824	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2b03c2fe6f1b8573e1c65e28424f4c5a9eb382a7216ea174449422714b5b9d98.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:824