be2473af07c842821c91aaab5d9c074c936fb1c0e7d6719dcc4c9ad6ab7188ed

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-01-2024 12:09

Target

be2473af07c842821c91aaab5d9c074c936fb1c0e7d6719dcc4c9ad6ab7188ed.dll
Size

397KB
MD5

2b8f798f1138010bc92a2dbef0890c31
SHA1

98f2b12437bb2a101ae411c2adc4c0f432371197
SHA256

be2473af07c842821c91aaab5d9c074c936fb1c0e7d6719dcc4c9ad6ab7188ed
SHA512

335d689a3e944da2a3098aa7db666804edb11e6f9a565ffb1371f230246fea7f8c67540cf618f154c9fe5636f25a546e5e9e6711a67559cb57a7837e334c57e6
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa5:174g2LDeiPDImOkx2LIa5

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	rundll32.exe
Token: SeTcbPrivilege	2676	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2676	2004	rundll32.exe	28
PID 2004 wrote to memory of 2676	2004	rundll32.exe	28
PID 2004 wrote to memory of 2676	2004	rundll32.exe	28
PID 2004 wrote to memory of 2676	2004	rundll32.exe	28
PID 2004 wrote to memory of 2676	2004	rundll32.exe	28
PID 2004 wrote to memory of 2676	2004	rundll32.exe	28
PID 2004 wrote to memory of 2676	2004	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\be2473af07c842821c91aaab5d9c074c936fb1c0e7d6719dcc4c9ad6ab7188ed.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be2473af07c842821c91aaab5d9c074c936fb1c0e7d6719dcc4c9ad6ab7188ed.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676