8781602bc5a2c8854c26f049b81fc13ed8c96bd674b4761244b7acabe20a8e83

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 14:44

Target

8781602bc5a2c8854c26f049b81fc13ed8c96bd674b4761244b7acabe20a8e83.dll
Size

397KB
MD5

340f50c37de67a4636831dc708bb5779
SHA1

97eadcb5c5666a6e77a39cf8ebdc07de120fd389
SHA256

8781602bc5a2c8854c26f049b81fc13ed8c96bd674b4761244b7acabe20a8e83
SHA512

9dadc2e315dad602d54d119f384d54744ab61f4c994c8fb34d45d715a7c616cd836fc11da715a7dce2e2f2d837cb9ae46a920bedbe25e40d84c510d0e62eadc7
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaB:174g2LDeiPDImOkx2LIaB

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	rundll32.exe
Token: SeTcbPrivilege	2400	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2400	1752	rundll32.exe	28
PID 1752 wrote to memory of 2400	1752	rundll32.exe	28
PID 1752 wrote to memory of 2400	1752	rundll32.exe	28
PID 1752 wrote to memory of 2400	1752	rundll32.exe	28
PID 1752 wrote to memory of 2400	1752	rundll32.exe	28
PID 1752 wrote to memory of 2400	1752	rundll32.exe	28
PID 1752 wrote to memory of 2400	1752	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8781602bc5a2c8854c26f049b81fc13ed8c96bd674b4761244b7acabe20a8e83.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8781602bc5a2c8854c26f049b81fc13ed8c96bd674b4761244b7acabe20a8e83.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400