2828ef23490e06d3dd9f9be7e8130fb632dab8b3f6cedc6374b985e225f67b23

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 12:00

Target

2828ef23490e06d3dd9f9be7e8130fb632dab8b3f6cedc6374b985e225f67b23.dll
Size

397KB
MD5

07a49b06008340ffb38678bc2e6ec894
SHA1

8acc7da78e512c00250dbd7409ac08952e5fcfb6
SHA256

2828ef23490e06d3dd9f9be7e8130fb632dab8b3f6cedc6374b985e225f67b23
SHA512

a0a4b2912b6ab455e6da1621bd30612d63e62cf1ad4cfa9085154dfdeb5ae26e83ce842b0fe2332a315313958e948c41521a9ceeac0202868d794a53270e4233
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOau:174g2LDeiPDImOkx2LIau

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	rundll32.exe
Token: SeTcbPrivilege	1708	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14
PID 2332 wrote to memory of 1708	2332	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2828ef23490e06d3dd9f9be7e8130fb632dab8b3f6cedc6374b985e225f67b23.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2332