e067c7a038403d9d5a8337fab426123d570e3438a14d64566ecc7a09bcbbf91b

Analysis

max time kernel
147s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 12:21

Target

5381073b7283b1210b1fba83c0d6280f.dll
Size

10KB
MD5

5381073b7283b1210b1fba83c0d6280f
SHA1

67c43a7ad55b4ca6b9c5fe052506ffe2fb860b12
SHA256

e067c7a038403d9d5a8337fab426123d570e3438a14d64566ecc7a09bcbbf91b
SHA512

67feb254077667127e374301c75792b5ec470e2fdee4a7417c03e82ce8687dba6d41e1c7a5650672cb5a0725f468e5f7eb7ec2a1a1b0edf70fcd5945a99f1de3
SSDEEP

192:pOZ/PwYdK7Ld8eUUyviXWJadeZYA/tIdl4Gzkj0Wf/N8kpyMBGXkgUw9w:pk/PwYk91HmJade2Aid2Ckjd+kpyMBbP

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3076	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3076	2076	rundll32.exe	14
PID 2076 wrote to memory of 3076	2076	rundll32.exe	14
PID 2076 wrote to memory of 3076	2076	rundll32.exe	14
PID 3076 wrote to memory of 3488	3076	rundll32.exe	49

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5381073b7283b1210b1fba83c0d6280f.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2076

memory/3076-0-0x000000000F000000-0x000000000F014000-memory.dmp

Filesize
80KB

Download