168fd10991a4112981d79b98b98bbabc6eb7ccdb1b3dd8606a262857e32b3385

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 12:54

Target

168fd10991a4112981d79b98b98bbabc6eb7ccdb1b3dd8606a262857e32b3385.dll
Size

397KB
MD5

43065f404d893e634b98a350477dfffc
SHA1

2c039b4f6e8642f3421eaaea6b33fe96e32667fe
SHA256

168fd10991a4112981d79b98b98bbabc6eb7ccdb1b3dd8606a262857e32b3385
SHA512

f13b3b0a7fb52782e1c0ed47e5481da193b41d7c507317cec6ccd7928116fab301564fc83c91fd19f4ce61311376b5cb8590589b2a09c83ab7ca725fee50c798
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaT:174g2LDeiPDImOkx2LIaT

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2248	rundll32.exe
2248	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	rundll32.exe
Token: SeTcbPrivilege	2248	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28
PID 1488 wrote to memory of 2248	1488	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\168fd10991a4112981d79b98b98bbabc6eb7ccdb1b3dd8606a262857e32b3385.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\168fd10991a4112981d79b98b98bbabc6eb7ccdb1b3dd8606a262857e32b3385.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2248