e6f2e463ffad30da47f8561d2c9d125b406ba693d9dda5b665995df73b2e5eb5

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 11:41

Target

e6f2e463ffad30da47f8561d2c9d125b406ba693d9dda5b665995df73b2e5eb5.dll
Size

397KB
MD5

969317b2e82a7e5f8502a27bc38563b4
SHA1

f9f87f9c46fdce01cdfed24eb6273244578a2670
SHA256

e6f2e463ffad30da47f8561d2c9d125b406ba693d9dda5b665995df73b2e5eb5
SHA512

27141c9dd0f027da10ca3fc9678f6e5b6a4bc4f3287b3ff0252a37766936d16a3df09ae8cbbfebe8c7e947b730ff30a7c5f4eecffa64da074bf2644678a78b5f
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOal:174g2LDeiPDImOkx2LIal

Score

1^/10

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1132	rundll32.exe
Token: SeTcbPrivilege	1132	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1132	3060	rundll32.exe	28
PID 3060 wrote to memory of 1132	3060	rundll32.exe	28
PID 3060 wrote to memory of 1132	3060	rundll32.exe	28
PID 3060 wrote to memory of 1132	3060	rundll32.exe	28
PID 3060 wrote to memory of 1132	3060	rundll32.exe	28
PID 3060 wrote to memory of 1132	3060	rundll32.exe	28
PID 3060 wrote to memory of 1132	3060	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6f2e463ffad30da47f8561d2c9d125b406ba693d9dda5b665995df73b2e5eb5.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e6f2e463ffad30da47f8561d2c9d125b406ba693d9dda5b665995df73b2e5eb5.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1132