a8fa9b653d7ae86a7fdd4ca6bb7d5a5b382c274021e76095d4a7b6aa2e3858b1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 11:26

Target

a8fa9b653d7ae86a7fdd4ca6bb7d5a5b382c274021e76095d4a7b6aa2e3858b1.dll
Size

397KB
MD5

61bdef370f1de3aa59c1e03ff56658a0
SHA1

682a6b1d454b2d32f9267eac1fafdcd1173c750c
SHA256

a8fa9b653d7ae86a7fdd4ca6bb7d5a5b382c274021e76095d4a7b6aa2e3858b1
SHA512

4a7bb992e853dbca9c92cfd11cb30b1f702ee1436347149d022c82532171bdf8d3a5fd5d08febafec9ef97a423e0e48ba73bde903a631301ae0b485a2d1bc7ae
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaV:174g2LDeiPDImOkx2LIaV

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2456	rundll32.exe
Token: SeTcbPrivilege	2456	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28
PID 2536 wrote to memory of 2456	2536	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8fa9b653d7ae86a7fdd4ca6bb7d5a5b382c274021e76095d4a7b6aa2e3858b1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a8fa9b653d7ae86a7fdd4ca6bb7d5a5b382c274021e76095d4a7b6aa2e3858b1.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456