6cbd4f78c092b497183ed937cd673af8483a0ead65e272df7950f3ef1eb19236

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 11:29

Target

6cbd4f78c092b497183ed937cd673af8483a0ead65e272df7950f3ef1eb19236.dll
Size

397KB
MD5

a7d0ec0e53625671e1d8f0686de51b93
SHA1

a257bfb5e57474492d84e9690da3354bf41c9dcb
SHA256

6cbd4f78c092b497183ed937cd673af8483a0ead65e272df7950f3ef1eb19236
SHA512

92820adaddac15d08b676c66885a543db5bd84f88edd04aab2f2d2bf95e7c9df5ddefb11b7269d73fd5edad59a8ebb52008e7340adeb4e1fe5c669ed12bb9bff
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOai:174g2LDeiPDImOkx2LIai

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	rundll32.exe
Token: SeTcbPrivilege	2392	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2392	2032	rundll32.exe	14
PID 2032 wrote to memory of 2392	2032	rundll32.exe	14
PID 2032 wrote to memory of 2392	2032	rundll32.exe	14
PID 2032 wrote to memory of 2392	2032	rundll32.exe	14
PID 2032 wrote to memory of 2392	2032	rundll32.exe	14
PID 2032 wrote to memory of 2392	2032	rundll32.exe	14
PID 2032 wrote to memory of 2392	2032	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6cbd4f78c092b497183ed937cd673af8483a0ead65e272df7950f3ef1eb19236.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2032