b01fdf2eb382761bb3ba76beb9a655617d1900b9b54f4584e7c18b29665d1253

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 12:44

Target

b01fdf2eb382761bb3ba76beb9a655617d1900b9b54f4584e7c18b29665d1253.dll
Size

397KB
MD5

a961cc787020e60453437750405320e1
SHA1

92987d46fe3ec6d9e9d6dc32ef43015aa737bfff
SHA256

b01fdf2eb382761bb3ba76beb9a655617d1900b9b54f4584e7c18b29665d1253
SHA512

c8c4c2696b923f252e32a07fc8ee0ffb3de962c973a10c3067232a1689faf9954ea7ceada28d4da735f3eaf2978154da22a828fdf895a2f7d65f40fe4415c1f3
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa3:174g2LDeiPDImOkx2LIa3

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	rundll32.exe
Token: SeTcbPrivilege	3012	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 3012	2652	rundll32.exe	16
PID 2652 wrote to memory of 3012	2652	rundll32.exe	16
PID 2652 wrote to memory of 3012	2652	rundll32.exe	16
PID 2652 wrote to memory of 3012	2652	rundll32.exe	16
PID 2652 wrote to memory of 3012	2652	rundll32.exe	16
PID 2652 wrote to memory of 3012	2652	rundll32.exe	16
PID 2652 wrote to memory of 3012	2652	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b01fdf2eb382761bb3ba76beb9a655617d1900b9b54f4584e7c18b29665d1253.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652