8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 15:21

Target

8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll
Size

397KB
MD5

efcec2128711aca7aa018b62ae5e765d
SHA1

36888f07b008868b31aafb6d1449ec64b2fbf26d
SHA256

8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79
SHA512

37e72d7bd6d8e917f959e5103d53d571d9dd56ae63149ffd0fc6b7e11896d09a8b67e5325dfab08add2acf527a9ec73291b6d8ac64144cf1b9345efc26454697
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaI:174g2LDeiPDImOkx2LIaI

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2876	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	rundll32.exe
Token: SeTcbPrivilege	2876	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2876	2860	rundll32.exe	27
PID 2860 wrote to memory of 2876	2860	rundll32.exe	27
PID 2860 wrote to memory of 2876	2860	rundll32.exe	27
PID 2860 wrote to memory of 2876	2860	rundll32.exe	27
PID 2860 wrote to memory of 2876	2860	rundll32.exe	27
PID 2860 wrote to memory of 2876	2860	rundll32.exe	27
PID 2860 wrote to memory of 2876	2860	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb6d5ecb457b88efb99957fba01673b3418d55f7dfae76d4499c4f1aeabcb79.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876