071ad9ffee02b5cedc7df6140973d9895684db94c39cfaa30e3508b0f95d9d88

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 11:34

Target

071ad9ffee02b5cedc7df6140973d9895684db94c39cfaa30e3508b0f95d9d88.dll
Size

397KB
MD5

ca5d2cd2174035827f584b5902b5a2e8
SHA1

b5b613a01f4910a4169495ef34060e53ed3d987a
SHA256

071ad9ffee02b5cedc7df6140973d9895684db94c39cfaa30e3508b0f95d9d88
SHA512

a7e6df6acd808a2ffb410a240276af15bc588b395ebd40c17024cd3a31fa4f65f12abbc410de5840ff8d07860d95b7d22b0dbf44f2854f424924ad060a25388a
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaE:174g2LDeiPDImOkx2LIaE

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	rundll32.exe
Token: SeTcbPrivilege	2240	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2240	2288	rundll32.exe	28
PID 2288 wrote to memory of 2240	2288	rundll32.exe	28
PID 2288 wrote to memory of 2240	2288	rundll32.exe	28
PID 2288 wrote to memory of 2240	2288	rundll32.exe	28
PID 2288 wrote to memory of 2240	2288	rundll32.exe	28
PID 2288 wrote to memory of 2240	2288	rundll32.exe	28
PID 2288 wrote to memory of 2240	2288	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\071ad9ffee02b5cedc7df6140973d9895684db94c39cfaa30e3508b0f95d9d88.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\071ad9ffee02b5cedc7df6140973d9895684db94c39cfaa30e3508b0f95d9d88.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240