26b9dd60fab2a5b2238e07cd14333b7a485e79b24e61921973ea3ca1111688bb

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 11:08

Target

26b9dd60fab2a5b2238e07cd14333b7a485e79b24e61921973ea3ca1111688bb.dll
Size

397KB
MD5

a35716db638c5b67325a3873e41bba0d
SHA1

abe9ebe89a4c5d2fddb91cff1bddd0e831035fae
SHA256

26b9dd60fab2a5b2238e07cd14333b7a485e79b24e61921973ea3ca1111688bb
SHA512

f0824598130f01c9cb0754e757bf33645e525b9bda8f17e50212443317a049a9300132a2c33a39ff13c4dded165f66a7dd86e1d90408812e14654a25304d6891
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaL:174g2LDeiPDImOkx2LIaL

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3048	rundll32.exe
3048	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	rundll32.exe
Token: SeTcbPrivilege	3048	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3048	3036	rundll32.exe	16
PID 3036 wrote to memory of 3048	3036	rundll32.exe	16
PID 3036 wrote to memory of 3048	3036	rundll32.exe	16
PID 3036 wrote to memory of 3048	3036	rundll32.exe	16
PID 3036 wrote to memory of 3048	3036	rundll32.exe	16
PID 3036 wrote to memory of 3048	3036	rundll32.exe	16
PID 3036 wrote to memory of 3048	3036	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26b9dd60fab2a5b2238e07cd14333b7a485e79b24e61921973ea3ca1111688bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26b9dd60fab2a5b2238e07cd14333b7a485e79b24e61921973ea3ca1111688bb.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048