31b017e658c91580e87cd8233d5dbff9e79ff8d33b88b9e9f588a1808d2176bb

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 11:48

Target

31b017e658c91580e87cd8233d5dbff9e79ff8d33b88b9e9f588a1808d2176bb.dll
Size

397KB
MD5

e0731b05ad4c37f810d5763afd6d891d
SHA1

056aba89f908a5de4659b904bb3e9bf0e2761449
SHA256

31b017e658c91580e87cd8233d5dbff9e79ff8d33b88b9e9f588a1808d2176bb
SHA512

84da95216a8792cbb0e83eb9f003f4d962c7aa58fd630af8c041bbbfe973e7ca6f9702c174050b4838020f2dc21a7636304ea95530652f80d5e429ad69b5f48a
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOaG:174g2LDeiPDImOkx2LIaG

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	rundll32.exe
Token: SeTcbPrivilege	2068	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 2068	2772	rundll32.exe	28
PID 2772 wrote to memory of 2068	2772	rundll32.exe	28
PID 2772 wrote to memory of 2068	2772	rundll32.exe	28
PID 2772 wrote to memory of 2068	2772	rundll32.exe	28
PID 2772 wrote to memory of 2068	2772	rundll32.exe	28
PID 2772 wrote to memory of 2068	2772	rundll32.exe	28
PID 2772 wrote to memory of 2068	2772	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\31b017e658c91580e87cd8233d5dbff9e79ff8d33b88b9e9f588a1808d2176bb.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\31b017e658c91580e87cd8233d5dbff9e79ff8d33b88b9e9f588a1808d2176bb.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2068