7a8790d4fb64aeb2d50724f470258922c2d4782d20233b2ad1ecf79d6addee87

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 13:33

Target

7a8790d4fb64aeb2d50724f470258922c2d4782d20233b2ad1ecf79d6addee87.dll
Size

397KB
MD5

49f909ac937f4270c130137421f8a4b6
SHA1

26aaf471e11f278ed15aeb212cbe8cb193c25d4a
SHA256

7a8790d4fb64aeb2d50724f470258922c2d4782d20233b2ad1ecf79d6addee87
SHA512

70a18a8efcd3cefb69a92adca59dd9a9c990f0c093ddc42be6f13e64f281feee88000113b01b13fb47937384a2541d2bcafd61a276f86c78ee9d1bfac5ce5b75
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOah:174g2LDeiPDImOkx2LIah

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1700	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	rundll32.exe
Token: SeTcbPrivilege	1700	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 1700	1212	rundll32.exe	28
PID 1212 wrote to memory of 1700	1212	rundll32.exe	28
PID 1212 wrote to memory of 1700	1212	rundll32.exe	28
PID 1212 wrote to memory of 1700	1212	rundll32.exe	28
PID 1212 wrote to memory of 1700	1212	rundll32.exe	28
PID 1212 wrote to memory of 1700	1212	rundll32.exe	28
PID 1212 wrote to memory of 1700	1212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a8790d4fb64aeb2d50724f470258922c2d4782d20233b2ad1ecf79d6addee87.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\7a8790d4fb64aeb2d50724f470258922c2d4782d20233b2ad1ecf79d6addee87.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700