047e0e000a23ca3bb7eed6e985152aeb048ba7a8e0eb17770f3a698e75224902

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-01-2024 14:32

Target

047e0e000a23ca3bb7eed6e985152aeb048ba7a8e0eb17770f3a698e75224902.dll
Size

397KB
MD5

864919ddbb32a111e2ce33c92fae102f
SHA1

9f9168fb6fadd20f4b1416e81684888a64569f4b
SHA256

047e0e000a23ca3bb7eed6e985152aeb048ba7a8e0eb17770f3a698e75224902
SHA512

62e860bfeca7447f9014061d3932356a920dcb194b72072f8aa7383823c4bb62fabb43d4fa60efa44aced3757494a8805be9b0e4b5812c89a490818e5a991fa4
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaP:174g2LDeiPDImOkx2LIaP

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	rundll32.exe
Token: SeTcbPrivilege	1936	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1936	1956	rundll32.exe	14
PID 1956 wrote to memory of 1936	1956	rundll32.exe	14
PID 1956 wrote to memory of 1936	1956	rundll32.exe	14
PID 1956 wrote to memory of 1936	1956	rundll32.exe	14
PID 1956 wrote to memory of 1936	1956	rundll32.exe	14
PID 1956 wrote to memory of 1936	1956	rundll32.exe	14
PID 1956 wrote to memory of 1936	1956	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\047e0e000a23ca3bb7eed6e985152aeb048ba7a8e0eb17770f3a698e75224902.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1956