367f17589d98123ada264e2bf01f2246379a5310dacdd9e32bf0ba291c700b45

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 15:54

Target

367f17589d98123ada264e2bf01f2246379a5310dacdd9e32bf0ba291c700b45.dll
Size

397KB
MD5

85782a79a42ec0b22c231439b077b0d8
SHA1

27ba088d01cbd0212abc815ae240e0febb1f67f5
SHA256

367f17589d98123ada264e2bf01f2246379a5310dacdd9e32bf0ba291c700b45
SHA512

457d24adad9af65d50c9e19ff05e32a4b43cd02a2938d86b18cbce97656bfc6aece558a930e5e5e9875951f54d6035838d87eb40e0bb6571332d76a120e13498
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOa0:174g2LDeiPDImOkx2LIa0

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	rundll32.exe
Token: SeTcbPrivilege	3032	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 3032	2940	rundll32.exe	28
PID 2940 wrote to memory of 3032	2940	rundll32.exe	28
PID 2940 wrote to memory of 3032	2940	rundll32.exe	28
PID 2940 wrote to memory of 3032	2940	rundll32.exe	28
PID 2940 wrote to memory of 3032	2940	rundll32.exe	28
PID 2940 wrote to memory of 3032	2940	rundll32.exe	28
PID 2940 wrote to memory of 3032	2940	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\367f17589d98123ada264e2bf01f2246379a5310dacdd9e32bf0ba291c700b45.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\367f17589d98123ada264e2bf01f2246379a5310dacdd9e32bf0ba291c700b45.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3032