e554901fd3b8feeadd2ca4d37660d90df284fb25ce2a8252bad0389fbf45c97f

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 14:24

Target

e554901fd3b8feeadd2ca4d37660d90df284fb25ce2a8252bad0389fbf45c97f.dll
Size

397KB
MD5

35c345db44bd216c9627d15ae240a945
SHA1

e862bf8bf804808c7450ef430a593f9a4158a1cd
SHA256

e554901fd3b8feeadd2ca4d37660d90df284fb25ce2a8252bad0389fbf45c97f
SHA512

8b7c7a8e383a0adcc1960704d96f82bcccb5d4e6160d10b1873d910d723fc95e74dea98ddc84aa3dcb5378ee5b19b9954559b10960ece70f6b882d5e0baf9ac0
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaJ:174g2LDeiPDImOkx2LIaJ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
868	rundll32.exe
868	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	rundll32.exe
Token: SeTcbPrivilege	868	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 868	2248	rundll32.exe	15
PID 2248 wrote to memory of 868	2248	rundll32.exe	15
PID 2248 wrote to memory of 868	2248	rundll32.exe	15
PID 2248 wrote to memory of 868	2248	rundll32.exe	15
PID 2248 wrote to memory of 868	2248	rundll32.exe	15
PID 2248 wrote to memory of 868	2248	rundll32.exe	15
PID 2248 wrote to memory of 868	2248	rundll32.exe	15

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e554901fd3b8feeadd2ca4d37660d90df284fb25ce2a8252bad0389fbf45c97f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2248