9aa5c83122ab9995af89278df50e5efd72c040b35ecd748a828834d9a9f588ff

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 15:41

Target

9aa5c83122ab9995af89278df50e5efd72c040b35ecd748a828834d9a9f588ff.dll
Size

397KB
MD5

10db2abe9ceba6234b4ce2a972c2223b
SHA1

bfe06326b51ff5aa95c3e30924065176b7378577
SHA256

9aa5c83122ab9995af89278df50e5efd72c040b35ecd748a828834d9a9f588ff
SHA512

4d0d0a76892915a8a78146257490a388b8a8744b1987686ea4134b93e23f569341d09fb7619045651d97fa5ea71a715c4c461b3af1cd53956a91d4bb0cb27894
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaQ:174g2LDeiPDImOkx2LIaQ

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3000	rundll32.exe
3000	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	rundll32.exe
Token: SeTcbPrivilege	3000	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3000	2996	rundll32.exe	16
PID 2996 wrote to memory of 3000	2996	rundll32.exe	16
PID 2996 wrote to memory of 3000	2996	rundll32.exe	16
PID 2996 wrote to memory of 3000	2996	rundll32.exe	16
PID 2996 wrote to memory of 3000	2996	rundll32.exe	16
PID 2996 wrote to memory of 3000	2996	rundll32.exe	16
PID 2996 wrote to memory of 3000	2996	rundll32.exe	16

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9aa5c83122ab9995af89278df50e5efd72c040b35ecd748a828834d9a9f588ff.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9aa5c83122ab9995af89278df50e5efd72c040b35ecd748a828834d9a9f588ff.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3000