927a25f702310ed2f50b9fa5367c3b236e442885ddc0dcc44e6a631a129675c9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 11:33

Target

927a25f702310ed2f50b9fa5367c3b236e442885ddc0dcc44e6a631a129675c9.dll
Size

397KB
MD5

7dc4faa49e394a3cb48af185f6d19e05
SHA1

4e1c20da77283dfee8f2fcd06e2ec17eadeb58ea
SHA256

927a25f702310ed2f50b9fa5367c3b236e442885ddc0dcc44e6a631a129675c9
SHA512

fd530dcca1d82764deeeef327e49defd07ef2667b2ac5f6b6e2ddc8e67b0f270a634062a7ea258ac23855d46b8d63283042e4bf93d6e5ab84a7a96e598727384
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOag:174g2LDeiPDImOkx2LIag

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2748	rundll32.exe
2748	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	rundll32.exe
Token: SeTcbPrivilege	2748	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2748	2136	rundll32.exe	28
PID 2136 wrote to memory of 2748	2136	rundll32.exe	28
PID 2136 wrote to memory of 2748	2136	rundll32.exe	28
PID 2136 wrote to memory of 2748	2136	rundll32.exe	28
PID 2136 wrote to memory of 2748	2136	rundll32.exe	28
PID 2136 wrote to memory of 2748	2136	rundll32.exe	28
PID 2136 wrote to memory of 2748	2136	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\927a25f702310ed2f50b9fa5367c3b236e442885ddc0dcc44e6a631a129675c9.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\927a25f702310ed2f50b9fa5367c3b236e442885ddc0dcc44e6a631a129675c9.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748