640bd1bbc48bf738e3f66e347d0a63600f8568d8b22a881c72e2356fa7a277d1

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 11:50

Target

640bd1bbc48bf738e3f66e347d0a63600f8568d8b22a881c72e2356fa7a277d1.dll
Size

397KB
MD5

f4d358667975f1e65843ad63f79b32e8
SHA1

fe99998a8ac6dbc41ec29fc8f1e0fdc7c01d71b9
SHA256

640bd1bbc48bf738e3f66e347d0a63600f8568d8b22a881c72e2356fa7a277d1
SHA512

121c5e959eeccb1613ab46f70297f0b93fb0301b7156be244e43655fdaea42b37c7ac782eb46208390b25e2757e95680e1e2fb3516e7cdc08fda8868e6ebd07c
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOae:174g2LDeiPDImOkx2LIae

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1480	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1480	rundll32.exe
Token: SeTcbPrivilege	1480	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1480	2524	rundll32.exe	28
PID 2524 wrote to memory of 1480	2524	rundll32.exe	28
PID 2524 wrote to memory of 1480	2524	rundll32.exe	28
PID 2524 wrote to memory of 1480	2524	rundll32.exe	28
PID 2524 wrote to memory of 1480	2524	rundll32.exe	28
PID 2524 wrote to memory of 1480	2524	rundll32.exe	28
PID 2524 wrote to memory of 1480	2524	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\640bd1bbc48bf738e3f66e347d0a63600f8568d8b22a881c72e2356fa7a277d1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\640bd1bbc48bf738e3f66e347d0a63600f8568d8b22a881c72e2356fa7a277d1.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1480