9396b5cefb15f72e27b83f62d2fa015209d262c25ececb5fd1759140ec30ca69

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 12:39

Target

9396b5cefb15f72e27b83f62d2fa015209d262c25ececb5fd1759140ec30ca69.dll
Size

397KB
MD5

99f9eb15d43d06725a83c4165be7e169
SHA1

570b3fcefc45c59d20034ff1b1e5927125fdfd95
SHA256

9396b5cefb15f72e27b83f62d2fa015209d262c25ececb5fd1759140ec30ca69
SHA512

a67dc13afa63c8ca70cfb4883915f6fbb72e3f7036a7387d1c4ade67093f9171d488f2461e806c889ad03f60301373e237b735ee7e80267886ef95e7aa11f135
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaH:174g2LDeiPDImOkx2LIaH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3048	rundll32.exe
3048	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3048	rundll32.exe
Token: SeTcbPrivilege	3048	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3048	3044	rundll32.exe	14
PID 3044 wrote to memory of 3048	3044	rundll32.exe	14
PID 3044 wrote to memory of 3048	3044	rundll32.exe	14
PID 3044 wrote to memory of 3048	3044	rundll32.exe	14
PID 3044 wrote to memory of 3048	3044	rundll32.exe	14
PID 3044 wrote to memory of 3048	3044	rundll32.exe	14
PID 3044 wrote to memory of 3048	3044	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9396b5cefb15f72e27b83f62d2fa015209d262c25ececb5fd1759140ec30ca69.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3044