7bd32574376f3f4b6c7f90270bbf8acb8063961176ae78a4d989e81874947237

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2024, 04:41

Target

55846474ab9f269a0969d0fa21a5f18e.dll
Size

11KB
MD5

55846474ab9f269a0969d0fa21a5f18e
SHA1

4dbe20c1acde499062ae5cb222c422d3d014cbbd
SHA256

7bd32574376f3f4b6c7f90270bbf8acb8063961176ae78a4d989e81874947237
SHA512

ed5d8116b1b474219664020c40fc3c531fc25b5d5ecfdd5c3b57f0fac110d6bff0d1139e1c6413223234df949d95e8e46c4d76848303c47f9e344cb19e9c5cf4
SSDEEP

192:17cimqSBzZWQ2pcr6H+vUobePDp67sSMIqp2IdXJX3JJZQeRLHAAK88hwkgUw9W:17cimZpM9ev5beosSMbPJDQMfKV5

Score

5^/10

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msepbe.dll	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2572	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 2572	4844	rundll32.exe	30
PID 4844 wrote to memory of 2572	4844	rundll32.exe	30
PID 4844 wrote to memory of 2572	4844	rundll32.exe	30
PID 2572 wrote to memory of 3420	2572	rundll32.exe	49

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\55846474ab9f269a0969d0fa21a5f18e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\55846474ab9f269a0969d0fa21a5f18e.dll,#1
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2572

memory/2572-2-0x000000000F000000-0x000000000F015000-memory.dmp

Filesize
84KB

Download