e067c7a038403d9d5a8337fab426123d570e3438a14d64566ecc7a09bcbbf91b

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 12:21

Target

5381073b7283b1210b1fba83c0d6280f.dll
Size

10KB
MD5

5381073b7283b1210b1fba83c0d6280f
SHA1

67c43a7ad55b4ca6b9c5fe052506ffe2fb860b12
SHA256

e067c7a038403d9d5a8337fab426123d570e3438a14d64566ecc7a09bcbbf91b
SHA512

67feb254077667127e374301c75792b5ec470e2fdee4a7417c03e82ce8687dba6d41e1c7a5650672cb5a0725f468e5f7eb7ec2a1a1b0edf70fcd5945a99f1de3
SSDEEP

192:pOZ/PwYdK7Ld8eUUyviXWJadeZYA/tIdl4Gzkj0Wf/N8kpyMBGXkgUw9w:pk/PwYk91HmJade2Aid2Ckjd+kpyMBbP

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1668	2132	rundll32.exe	28
PID 2132 wrote to memory of 1668	2132	rundll32.exe	28
PID 2132 wrote to memory of 1668	2132	rundll32.exe	28
PID 2132 wrote to memory of 1668	2132	rundll32.exe	28
PID 2132 wrote to memory of 1668	2132	rundll32.exe	28
PID 2132 wrote to memory of 1668	2132	rundll32.exe	28
PID 2132 wrote to memory of 1668	2132	rundll32.exe	28
PID 1668 wrote to memory of 1364	1668	rundll32.exe	21

memory/1364-4-0x0000000001CC0000-0x0000000001CC1000-memory.dmp

Filesize
4KB

Download
memory/1668-0-0x000000000F000000-0x000000000F014000-memory.dmp

Filesize
80KB

Download
memory/1668-1-0x000000000F000000-0x000000000F014000-memory.dmp

Filesize
80KB

Download