4880acac37c5a7e63ca00555913286cc0a6b3b17cd97ec5eac7372a78cde3a21

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 00:25

Target

4cda6bfc1743e7921c190297d1c8cadf.exe
Size

11KB
MD5

4cda6bfc1743e7921c190297d1c8cadf
SHA1

d317d3a1fd1d65d82e0a142d099fde66515c5b97
SHA256

4880acac37c5a7e63ca00555913286cc0a6b3b17cd97ec5eac7372a78cde3a21
SHA512

c5f5df1c5688ea8d9106b71029feca6480365c9df0fd8032d5e75540a43ed00f0baabb7d58265f60b7ecdb84bfa221ecb62ae4ea36f1637c39cf294fbb014b50
SSDEEP

192:3pa2G6AxQ8qAe28Qpvtb+yFGy7lTwy8GXvU23gnzC2lacTXDbDPKXa+C7ap:3pafxtmQvFGcw9ss2wzC2NTTHy87Y

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1760	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
1760	rundll32.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\gdipro.dll	rundll32.exe
File created	C:\Windows\SysWOW64\rpcss.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\rpcss.dll	rundll32.exe
File created	C:\Windows\SysWOW64\sys17002.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sys17002.dll	rundll32.exe
File created	C:\Windows\SysWOW64\sys17002.add	rundll32.exe
File created	C:\Windows\SysWOW64\gdipro.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1760	1748	4cda6bfc1743e7921c190297d1c8cadf.exe	28
PID 1748 wrote to memory of 1760	1748	4cda6bfc1743e7921c190297d1c8cadf.exe	28
PID 1748 wrote to memory of 1760	1748	4cda6bfc1743e7921c190297d1c8cadf.exe	28
PID 1748 wrote to memory of 1760	1748	4cda6bfc1743e7921c190297d1c8cadf.exe	28
PID 1748 wrote to memory of 1760	1748	4cda6bfc1743e7921c190297d1c8cadf.exe	28
PID 1748 wrote to memory of 1760	1748	4cda6bfc1743e7921c190297d1c8cadf.exe	28
PID 1748 wrote to memory of 1760	1748	4cda6bfc1743e7921c190297d1c8cadf.exe	28
PID 1760 wrote to memory of 1204	1760	rundll32.exe	17

C:\Users\Admin\AppData\Local\Temp\~f76193b.tmp

Filesize
34KB

MD5
c5ac9321d6bb21134d27b2138ac07029

SHA1
6a5fb4432b2956d1b53d54f18984551832105f42

SHA256
cc6997a2bea7e4c02a98866cc91cc7b67938537253da97e1adbbf1f4ab855aff

SHA512
80e64927d50826fff240e9ce7b52ae2d5b69ccbcab7d31a8250756170605d62d0d7c69c3e43ac9a75154d4e774ed2bf1f8731a0f2aa32e8c4adeee1834c29818

Download Submit
memory/1204-10-0x0000000003B30000-0x0000000003B31000-memory.dmp

Filesize
4KB

Download
memory/1760-5-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download