f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 16:15

Target

f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b.dll
Size

397KB
MD5

b700be3adbe30c3124c0657f85803924
SHA1

9342e8b905c694ff29a66ab1d848f5038c23094d
SHA256

f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b
SHA512

30a4ad7ebe084565b4f0b744659b06a7541618c23b2cbda7911f21367d0ab265d28230ad87060575a7a14b667fd44e37be5896665bd96545d88f0c181acf66f2
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOap:174g2LDeiPDImOkx2LIap

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	rundll32.exe
Token: SeTcbPrivilege	2308	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2308	1972	rundll32.exe	14
PID 1972 wrote to memory of 2308	1972	rundll32.exe	14
PID 1972 wrote to memory of 2308	1972	rundll32.exe	14
PID 1972 wrote to memory of 2308	1972	rundll32.exe	14
PID 1972 wrote to memory of 2308	1972	rundll32.exe	14
PID 1972 wrote to memory of 2308	1972	rundll32.exe	14
PID 1972 wrote to memory of 2308	1972	rundll32.exe	14

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f04a18fcdb9c7f76587ede0092db448f05a5466698181ca09c8794533ca5ee8b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1972