04ca3d994c23115cdb74614535683ae17ada863b83a14bce4f02917a63276d68

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-01-2024 16:13

Target

04ca3d994c23115cdb74614535683ae17ada863b83a14bce4f02917a63276d68.dll
Size

397KB
MD5

5ee8037156c991f168b124addad38cc9
SHA1

6b453b87c23f785e7248a0eac0286056edf921f1
SHA256

04ca3d994c23115cdb74614535683ae17ada863b83a14bce4f02917a63276d68
SHA512

382e18e5c19a381500d8e0704fd95ec6bd1025d26495555c42171340c4a76bc79f6c792d790232312c6f407c72bec8f32cb2b5f8c68d0df0a5863df2ff4d77f0
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOab:174g2LDeiPDImOkx2LIab

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	rundll32.exe
Token: SeTcbPrivilege	2228	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2228	2212	rundll32.exe	28
PID 2212 wrote to memory of 2228	2212	rundll32.exe	28
PID 2212 wrote to memory of 2228	2212	rundll32.exe	28
PID 2212 wrote to memory of 2228	2212	rundll32.exe	28
PID 2212 wrote to memory of 2228	2212	rundll32.exe	28
PID 2212 wrote to memory of 2228	2212	rundll32.exe	28
PID 2212 wrote to memory of 2228	2212	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\04ca3d994c23115cdb74614535683ae17ada863b83a14bce4f02917a63276d68.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\04ca3d994c23115cdb74614535683ae17ada863b83a14bce4f02917a63276d68.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228